Courseiva

CCNA troubleshooting Questions

75 of 120 questions · Page 1/2 · troubleshooting · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

A server administrator notices that a recently installed PCIe network card is not being recognized by the operating system. The server is running Windows Server 2019. The administrator has verified that the card is securely seated and that the slot is enabled in the BIOS. Which of the following should the administrator try FIRST to resolve the issue?

A.Check the Hardware Compatibility List (HCL) for Windows Server 2019.
B.Replace the network card with a known-good card.
C.Reseat the network card in a different PCIe slot.
D.Update the server BIOS to the latest version.
AnswerA

Ensuring the hardware is on the HCL verifies driver support, which is the most logical first step before further hardware or software changes.

Why this answer

Option B is correct because the first step when a newly installed device is not recognized should be to verify hardware compatibility with the operating system (checking the Hardware Compatibility List). This ensures the device has supported drivers. Options A and C are physical steps that have already been considered (secure seating, slot enabled), and D (updating BIOS) is a later step after confirming compatibility.

Practice this question →
2
MCQmedium

A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The administrator runs `iostat -x 1` and sees that the `%util` value for `/dev/sda` is consistently above 98%, while the `await` for write requests is over 500 ms. The server hosts a database that performs many small random writes. Which of the following is the MOST likely cause?

A.The disk is failing and needs to be replaced immediately.
B.The filesystem is corrupted, causing the kernel to repeatedly attempt repairs.
C.The server's RAM is insufficient, causing excessive swapping to disk.
D.The disk is experiencing a high number of I/O operations, and the storage subsystem cannot keep up with the demand.
AnswerD

The `%util` metric indicates the percentage of time the device spent servicing I/O requests. A value consistently near 100% means the disk is saturated, and high `await` (average time per request) confirms that requests are queuing. This matches the symptom of slow performance under a random-write workload that exceeds the disk's IOPS capability.

Why this answer

The `iostat` output shows the disk is saturated (`%util` near 100%) and requests are waiting (`await` over 500 ms). For a database with many small random writes, this indicates the storage cannot deliver the required IOPS. The correct answer identifies the disk as the bottleneck due to excessive I/O demand.

Exam trap

The trap here is assuming that high `await` always means a failing disk, when it can simply indicate a saturated but healthy disk under heavy load.

Practice this question →
3
MCQhard

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

A.Add a memory reservation for the VM in ESXi.
B.Check the host's memory utilization for ballooning or swapping.
C.Analyze the database query cache hit ratio and slow query logs.
D.Increase the VM's RAM allocation to 32GB.
AnswerB

Host memory pressure can force balloon driver activity or swapping, causing the VM to see less available RAM and triggering OOM. This is the correct first diagnostic step.

Why this answer

Option C is correct because the OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause.

B addresses database tuning, which is not indicated when the system reports OOM.

Practice this question →
4
MCQmedium

A server administrator is troubleshooting a Linux server that boots normally but takes over 20 minutes to reach a login prompt, while CPU, memory, and disk utilization remain low after boot. Running systemd-analyze blame shows a single unit consuming 18 minutes. Which of the following commands will BEST identify what that unit is waiting on?

A.systemctl status <unit-name> and journalctl -u <unit-name> -b
B.systemd-analyze critical-chain and systemd-analyze plot > boot.svg
C.iostat -x 5 3 and vmstat 1 10
D.dmesg | grep -i error and check /var/log/messages
AnswerA

Querying the unit's current state with systemctl status and reviewing its boot-time journal entries with journalctl -u <unit-name> -b reveals the dependency or timeout that consumed 18 minutes, such as a failed network mount or a service waiting on a device that never appears. This directly targets the slow unit identified by systemd-analyze blame rather than guessing at hardware.

Why this answer

Because systemd-analyze blame already isolated one unit consuming 18 minutes, the next diagnostic step is to inspect that unit directly. systemctl status reveals its state and dependencies, while journalctl -u <unit-name> -b shows the boot-session messages explaining the delay, such as a network mount timeout. Resource-monitoring and general log tools do not attribute boot latency to a specific unit.

Exam trap

The trap here is assuming a slow boot must be a hardware or resource bottleneck and jumping to iostat or vmstat instead of interrogating the specific unit systemd already flagged.

Practice this question →
5
MCQmedium

A server administrator is troubleshooting a server that is experiencing unexpected shutdowns. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. The server has a redundant power supply configuration, and both power supplies are connected to different PDUs. The administrator checks the PDUs and finds no power outages. Which of the following is the MOST likely cause of the unexpected shutdowns?

A.The PDUs are not providing enough power to the server, causing brownouts.
B.The server's power supplies are not properly seated or are failing intermittently.
C.The server's BIOS is configured to shut down when a redundant power supply fails.
D.The server's operating system is missing a critical update, causing random reboots.
AnswerB

Event ID 6008 indicates an unexpected shutdown, which often points to a hardware issue such as a faulty power supply. Even with redundant power supplies, if one is failing intermittently or not properly seated, it can cause the server to lose power if the other supply cannot handle the full load or if there is a brief interruption. Checking the power supply status LEDs and reseating them is a good first step. The lack of PDU outages suggests the issue is within the server's power subsystem.

Why this answer

Event ID 6008 indicates an unexpected shutdown, which is often caused by a power loss. Even with redundant power supplies, if one supply is failing intermittently or not properly connected, the server may shut down if the remaining supply cannot handle the load or if there is a brief power interruption. Checking the power supply status and reseating them is a logical step.

The lack of PDU outages rules out external power issues.

Exam trap

The trap here is assuming that redundant power supplies eliminate all power-related shutdowns, when in fact a faulty supply or a loose connection can still cause an unexpected shutdown.

Practice this question →
6
MCQhard

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

A.Reduce the number of vCPUs assigned to each VM
B.Increase memory reservation for all VMs
C.Migrate one or more VMs to another host
D.Enable transparent page sharing
AnswerC

Moving VMs to another host spreads the workload, decreasing CPU contention and storage I/O load on the original host.

Why this answer

Option B is correct because migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time.

Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Practice this question →
7
MCQmedium

A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a managed switch, and the administrator notices that the switch port shows a high number of CRC errors. Which of the following is the MOST likely cause?

A.The network cable is damaged or poorly terminated.
B.The server's network adapter driver is outdated.
C.The switch is experiencing a broadcast storm.
D.The switch port is configured for the wrong duplex setting.
AnswerA

CRC errors indicate that frames are being corrupted in transit, often due to physical layer issues such as damaged cables, poor connectors, or interference. Replacing or re-terminating the cable is the first step. High CRC errors are a classic symptom of cabling problems, making this the most likely cause.

Why this answer

CRC errors on a switch port almost always indicate a physical layer problem, such as a bad cable or connector. Intermittent connectivity with high CRC errors strongly suggests the cable is damaged or poorly terminated. Other options like duplex mismatch or driver issues do not typically produce CRC errors.

Exam trap

The trap here is attributing CRC errors to logical configuration issues like duplex or drivers, when they are actually physical layer errors.

Practice this question →
8
MCQmedium

A server administrator is investigating a production server that has been performing poorly for several days. Users report slow response times, and the administrator observes that CPU utilization stays near 100% even during off-peak hours. Task Manager shows the System process consuming most of the CPU. The administrator runs a performance counter capture and sees a sustained high rate of deferred procedure calls (DPCs). Which of the following is the MOST likely cause?

A.A memory leak in a user-mode application causing excessive paging
B.An overheating CPU throttling to a lower clock speed
C.A failing storage controller driver generating excessive interrupts
D.A misconfigured DNS server causing repeated name resolution retries
AnswerC

Excessive DPC time typically indicates a driver, often a storage or network driver, is spending too long in deferred procedure call routines. A failing or outdated storage controller driver can generate abnormal interrupt loads, driving up DPC time and CPU usage. This matches the sustained high DPC rate and System process CPU consumption described in the scenario.

Why this answer

Sustained high DPC time indicates a driver is spending excessive time in deferred procedure call routines, and the System process CPU usage reflects that kernel-level activity. Among the listed causes, only a failing storage controller driver would directly generate abnormal interrupt and DPC load. Memory leaks, thermal throttling, and DNS retries do not produce this specific performance counter pattern.

Exam trap

The trap here is assuming any high System process CPU usage points to a user-mode application or malware rather than a kernel-mode driver generating excessive interrupts.

Practice this question →
9
MCQhard

A server administrator is troubleshooting a Linux server that becomes unresponsive during nightly backup jobs. The administrator runs top and observes that the wa (I/O wait) value is consistently above 40%, while user and system CPU usage remain below 10%. The backup job writes to a locally attached RAID 5 array. Which of the following is the MOST likely cause of the high I/O wait?

A.The server's CPU is throttling due to excessive heat, causing processes to wait on I/O.
B.The RAID controller cache is disabled or the battery-backed write cache is in a failed state.
C.The backup application is using a compression algorithm that is CPU-intensive.
D.The network interface card is dropping packets, causing retransmissions and disk writes to stall.
AnswerB

A RAID controller without a functional write cache forces all writes to go directly to disk, dramatically increasing I/O wait during heavy write workloads like backups. If the battery-backed cache unit has failed or cache is disabled, write performance degrades severely. This matches the symptom of high I/O wait with low CPU usage during backup jobs.

Why this answer

High I/O wait with low CPU usage during write-heavy operations points to a storage bottleneck. A RAID controller with a disabled or failed write cache cannot buffer writes, forcing synchronous disk access and increasing I/O wait. Verifying the RAID controller cache status and battery condition is the most likely fix.

Exam trap

The trap here is attributing high I/O wait to CPU or network problems, when the low CPU usage and local storage target clearly indicate a storage subsystem bottleneck.

Practice this question →
10
MCQhard

A server in a virtualized environment is experiencing VM performance degradation. The host server has adequate resources. The hypervisor logs show excessive 'ready' time for the CPU. Which of the following is the BEST action to resolve this issue?

A.Disable hyper-threading on the host
B.Increase the number of vCPUs for the VM
C.Reduce the number of VMs on the host
D.Migrate the VM to a different host
AnswerC

Excessive CPU ready time indicates VMs are queuing for physical CPU despite adequate host resources, meaning the host is overcommitted on vCPU allocation. Reducing the number of VMs lowers contention, satisfying the stem's constraint that host resources are otherwise sufficient.

Why this answer

Reducing the number of VMs on the host reduces contention for CPU resources, decreasing ready time.

Practice this question →
11
MCQeasy

A server administrator is troubleshooting a server that is unable to connect to the network. The server's NIC link light is off. The administrator verifies that the switch port is enabled and the cable is connected to both the server and the switch. Which of the following should the administrator check NEXT?

A.The cable is faulty or not properly seated.
B.The switch port is configured for the wrong VLAN.
C.The cable is a crossover cable and needs to be replaced with a straight-through cable.
D.The NIC driver version and update if necessary.
AnswerA

A link light off indicates no physical link between the NIC and the switch. Even if the cable appears connected, it could be faulty or not fully seated. Testing with a known-good cable or reseating both ends is a logical next step. This is a common cause of a missing link light.

Why this answer

When the NIC link light is off, the issue is almost always physical layer: cable, port, or NIC hardware. Since the switch port is enabled and the cable is connected, the next step is to verify the cable's integrity and seating. Trying a different cable or reseating the existing one can quickly resolve the problem.

Other options address higher-layer issues that would not cause the link light to be off.

Exam trap

The trap here is jumping to configuration issues like VLAN or drivers when the link light being off points directly to a physical layer problem.

Practice this question →
12
MCQmedium

A server administrator receives alerts that a production Linux server is unresponsive. After connecting via out-of-band management, the administrator sees a message indicating a kernel panic. The system was recently updated with a new storage driver. Which of the following should the administrator do FIRST to troubleshoot this issue?

A.Reboot the server and select the previous kernel version from the boot loader menu.
B.Run a full memory diagnostic test to check for faulty RAM.
C.Replace the storage controller card with a known-good spare.
D.Reinstall the operating system from scratch to ensure a clean state.
AnswerA

Booting into the previous kernel isolates whether the recently updated storage driver caused the panic. If the system boots successfully with the older kernel, the new driver is the likely culprit, allowing the administrator to roll back or update the driver. This is a non-destructive first step that quickly confirms or eliminates the suspected change.

Why this answer

The kernel panic appeared right after a storage driver update, making that change the prime suspect. Booting the previous kernel version is a quick, reversible test that confirms whether the new driver is at fault. If the system boots, the administrator can then roll back the driver or obtain a fixed version.

Other options involve unnecessary hardware replacement, lengthy tests, or destructive reinstallation.

Exam trap

The trap here is assuming a kernel panic always indicates hardware failure, when a recent software change is the more likely cause.

Practice this question →
13
MCQhard

A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?

A.Add a second disk to the RAID 5 array (convert to RAID 6).
B.Migrate the VM to a different datastore with SSD storage.
C.Increase the VM's memory allocation.
D.Change the virtual disk type from thin to thick.
AnswerB

The RAID 5 SAS datastore is the bottleneck, delivering 200ms latency. Migrating the VM to SSD-backed storage removes the spinning-disk seek penalty, directly addressing the high virtual disk latency constraint rather than merely shifting load.

Why this answer

A virtual disk latency of 200ms on a RAID 5 SAS datastore at only 50% utilization strongly indicates a storage I/O bottleneck rather than capacity or memory pressure. Migrating the VM to an SSD-backed datastore dramatically reduces latency because SSDs deliver sub-millisecond random I/O versus mechanical SAS drives. This directly addresses the root cause without altering RAID geometry or VM configuration.

Exam trap

The trap is assuming that adding disks or changing RAID levels improves performance, when the real bottleneck is the mechanical latency of SAS drives—SSD migration is the direct fix.

How to eliminate wrong answers

Option A is wrong because converting RAID 5 to RAID 6 adds double parity, which increases write penalty and reduces usable capacity—it would likely worsen latency, not improve it. Option C is wrong because increasing VM memory does not address disk I/O latency; it only helps if the bottleneck were memory paging or cache misses. Option D is wrong because changing thin to thick provisioning only affects space allocation and possibly initial write performance, not the underlying storage latency of 200ms.

Practice this question →
14
Multi-Selectmedium

A server administrator is troubleshooting a Windows Server 2019 machine whose system event log repeatedly shows unexpected shutdowns with no bugcheck code. The hardware is suspected of causing the reboots. Which of the following should the administrator check to identify a hardware-related cause? (Choose two.)

Select 2 answers
A.Update the NIC firmware to the latest vendor release.
B.Check the power supply units and review the chassis intrusion and fan status indicators.
C.Examine the Windows Memory Diagnostic results for failing RAM modules.
D.Run sfc /scannow to repair corrupted Windows system files.
E.Review the baseboard management controller (BMC) or IPMI system event log for thermal or power events.
AnswersB, E

Degraded power supplies and stopped fans can cause abrupt power loss or thermal shutdowns that leave no OS bugcheck. Verifying PSU health along with fan and chassis status directly targets the hardware conditions that produce clean, unexpected reboots. This complements the management-controller log review by confirming the physical fault behind the logged event.

Why this answer

Unexpected shutdowns with no bugcheck usually originate below the operating system, so the investigation belongs at the hardware layer. Out-of-band management logs capture thermal and power events the OS cannot record, while physical inspection of power supplies and cooling confirms the fault. Software-level tools and network firmware updates do not explain a reset that bypasses the OS.

Exam trap

The trap here is choosing in-OS diagnostic tools for a symptom that occurs below the operating system, where only out-of-band and physical checks will show the cause.

Practice this question →
15
Multi-Selecthard

A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message that no bootable device is found. The administrator suspects that the firmware update reset the storage controller configuration. Which of the following should the administrator check? (Choose two.)

Select 2 answers
A.Run a memory diagnostic to rule out RAM failure.
B.Replace the CMOS battery to ensure BIOS settings are retained.
C.Verify that the boot order in the UEFI/BIOS includes the correct storage controller and drive.
D.Check that the RAID controller is set to the correct mode (e.g., RAID vs. AHCI) and that the virtual drive is imported.
E.Reinstall the operating system to restore boot files.
AnswersC, D

A firmware update can reset UEFI/BIOS settings to defaults, which may change the boot order. If the storage controller or drive is not in the boot order, the system will report no bootable device. Checking and correcting the boot order is a critical first step in resolving this issue.

Why this answer

The correct answers are to verify the boot order in UEFI/BIOS and to check the RAID controller mode and import any foreign configuration. Firmware updates often reset BIOS/UEFI settings, which can alter boot order or storage controller settings. Restoring these settings can make the boot device visible again, resolving the 'no bootable device' error without data loss.

Exam trap

The trap here is assuming hardware failure or OS corruption when a firmware update has simply reset critical storage and boot settings.

Practice this question →
16
MCQmedium

After a thunderstorm, a server in a remote office is reachable via remote console but has no network connectivity. The network switch port shows a steady link light, but the server's NIC shows no link light. Which of the following is the MOST likely cause?

A.TCP/IP stack corruption.
B.Switch port is administratively disabled.
C.Incorrect VLAN assignment on the switch port.
D.The NIC hardware has failed.
AnswerD

A failed NIC would not establish a link, explaining why the switch sees a link but the server does not—the fault lies between the server's NIC port and the cable.

Why this answer

Option C is correct. A lack of link light on the server's NIC while the switch has a link indicates a physical failure between the NIC and the cable, such as a damaged NIC. Option A would result in no link on the switch as well.

Option B would still allow the NIC to establish link. Option D would not affect link lights.

Practice this question →
17
MCQmedium

A server administrator is investigating a performance problem on a Windows Server 2019 file server. Users report that large file copies to a data volume take far longer than expected, but small file operations are fine. The administrator opens Performance Monitor and observes that the PhysicalDisk\Avg. Disk sec/Write counter for the array hosting the data volume is consistently between 40 and 60 ms, while the same counter on the OS volume stays under 5 ms. Disk queue length on the data volume remains low. Which of the following is the MOST likely cause?

A.The data volume's partition is misaligned to the underlying RAID stripe.
B.The data volume is formatted with the ReFS file system instead of NTFS.
C.The write-back cache on the RAID controller has been disabled or the battery-backed cache unit has failed.
D.The server's NIC teaming configuration is using a standby adapter for the data path.
AnswerC

Large sequential writes depend heavily on the controller's write-back cache to absorb and reorder I/O. When the cache is disabled or the battery/capacitor unit fails, the controller switches to write-through mode, so each write must commit to spinning media before the next is acknowledged. That raises latency on the data volume to tens of milliseconds while keeping queue length low, exactly matching the observed counters.

Why this answer

Elevated Avg. Disk sec/Write with a low queue length on a single array points to per-I/O latency rather than an overloaded queue. A failed battery-backed cache unit or disabled write-back cache forces the controller into write-through behavior, so each large write waits for physical media commit.

This selectively penalizes large sequential writes while leaving small operations and the OS volume unaffected.

Exam trap

The trap here is assuming high disk latency always means the array is overloaded with queued requests, when a low queue length with high per-write latency actually indicates the controller has lost its write cache.

Practice this question →
18
PBQeasy

A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?

A.Replace the power supply with a compatible, known-good unit.
B.Swap the motherboard with an identical one from a spare parts inventory.
C.Connect the server directly to a different power outlet, bypassing the surge protector.
D.Remove the server's RAM modules and reinstall them one at a time, testing after each.
AnswerA

Why this answer

Option B is correct: the brief fan spin with immediate shutdown and absence of POST is a classic sign of a failing power supply that cannot maintain output under load. After a power surge, the power supply is the most probable damaged component. Option A is wrong because motherboard failure would typically produce beep codes or consistent power without POST, and swapping it is high-effort without first testing the power supply.

Option C is wrong because RAM issues usually generate beep codes or a continuous power-on state with no boot, not the described brief spin-down. Option D is wrong because the administrator already confirmed other devices work on the same circuit, ruling out a supply-side issue.

Practice this question →
19
MCQeasy

A server administrator is troubleshooting a Linux server that has become unresponsive to SSH and console logins. The server is still powered on, and the fans are running. The administrator wants to check the system logs from a previous boot to determine if a kernel panic occurred. Which command should the administrator use?

A.tail -f /var/log/messages
B.journalctl -b -1
C.cat /proc/kmsg
D.dmesg
AnswerB

journalctl -b -1 displays the journal entries from the previous boot, which is exactly what the administrator needs to review kernel messages, including any panic or OOM events that preceded the hang. On systemd-based Linux distributions, this command reads persistent journal files if storage is enabled, making it the correct tool for post-mortem analysis of an unresponsive server.

Why this answer

When a Linux server becomes unresponsive, the administrator needs to inspect logs from the previous boot to identify a kernel panic or other fatal event. The systemd journal retains logs across reboots if persistent storage is configured. The journalctl -b -1 command specifically selects the boot before the current one, allowing review of kernel messages, service failures, and panic traces.

Other commands either show only the current boot or require a live, responsive system.

Exam trap

The trap here is reaching for dmesg or live log tailing when the server is unresponsive and the relevant evidence is from a prior boot, which requires a command that can access historical journal entries.

Practice this question →
20
MCQeasy

A server administrator receives alerts that a server's RAID 5 array has a failed drive. The administrator replaces the failed drive with a new one of the same model and capacity. After the rebuild completes, the administrator notices that the array is still showing as degraded. Which of the following is the MOST likely reason for the array remaining degraded?

A.Another drive in the array has failed or is reporting errors.
B.The new drive was not properly initialized or added to the array.
C.The replacement drive is not compatible with the RAID controller.
D.The RAID controller needs to be reset to recognize the new drive.
AnswerA

In a RAID 5 array, if a second drive fails during or after the rebuild, the array will remain degraded or fail entirely. The administrator should check the status of all drives. Often, a second drive may have pre-failure warnings that were overlooked. This is the most likely cause for the array not returning to optimal state.

Why this answer

After replacing a failed drive and completing a rebuild, a RAID 5 array should return to optimal. If it remains degraded, the most probable cause is an additional drive failure or errors on another drive. RAID 5 can tolerate only one drive failure; a second failure leaves the array degraded.

Checking all drive statuses is essential.

Exam trap

The trap here is assuming that a successful rebuild automatically restores the array to optimal, while overlooking the possibility of a second drive issue.

Practice this question →
21
MCQeasy

A server administrator is troubleshooting a server whose time drifts several minutes per day, causing Kerberos authentication failures between the server and its domain controller. The server is a domain member with no special role. Which of the following is the MOST appropriate first step to correct the time synchronization problem?

A.Restart the Windows Time (W32Time) service and verify the domain time source.
B.Increase the Kerberos ticket lifetime policy on the domain controller.
C.Replace the server's CMOS battery and set the BIOS clock manually.
D.Configure the server to synchronize with an external NTP pool instead of the domain hierarchy.
AnswerA

Restarting W32Time and confirming the configured source re-establishes synchronization with the domain hierarchy, which is the authoritative time source for a member server. This is a low-risk first step that directly targets the drifting clock and the resulting Kerberos failures, and it verifies whether the service or its source configuration is the problem before more invasive changes.

Why this answer

A domain member should obtain time from the domain hierarchy, so the first corrective action is to ensure the Windows Time service is running and configured to use that source. Kerberos rejects authentication when clock skew exceeds its tolerance, which explains the reported failures. External NTP pools, policy changes, and CMOS replacement do not address the loss of domain synchronization.

Exam trap

The trap here is reaching for an external NTP pool, when domain members are expected to inherit time from the domain hierarchy rather than an outside source.

Practice this question →
22
PBQmedium

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

A.Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.
B.Immediately add more vCPUs to the virtual machine to handle the increased load.
C.Identify and kill the offending long-running query using the SQL Server management tools.
D.Restart the SQL Server service to clear all active connections and start fresh.
AnswerC

Why this answer

Option A is the correct immediate action. Identifying and terminating the specific offending query is the fastest way to restore normal operation without disrupting other database activities. Option B (adding vCPUs) is not a quick fix and doesn't address the root cause.

Option C (restarting the SQL service) will disconnect all users and cause unnecessary downtime. Option D (increasing the VM's memory) won't help a CPU-bound problem caused by an inefficient query.

Practice this question →
23
MCQhard

A server that uses iSCSI storage has suddenly lost connectivity to all LUNs. The network team confirms no changes have been made. Which of the following is the FIRST step in troubleshooting this issue?

A.Check the VLAN configuration on the switch.
B.Replace the network cables to the storage array.
C.Verify the status of the iSCSI initiator service on the server.
D.Reconfigure the IP address of the server.
AnswerC

Verifying the iSCSI initiator service directly addresses the server-side software that maintains session state to every LUN. If the Microsoft iSCSI Initiator service has stopped or crashed, all targets drop simultaneously despite an unchanged network, matching the stem's sudden total loss of connectivity. Restarting it restores sessions without network investigation.

Why this answer

The first step in troubleshooting iSCSI connectivity loss is to verify the status of the iSCSI initiator service on the server, because if the service is stopped or failed, the server cannot connect to any LUNs. This is a local, non-disruptive check that should precede network or hardware changes. It aligns with the troubleshooting principle of checking the most likely and least invasive cause first.

Exam trap

SK0-005 often tests the order of troubleshooting steps — candidates may jump to network or hardware fixes, but the FIRST step should be the least invasive local check, such as the iSCSI initiator service.

How to eliminate wrong answers

Option A is wrong because checking VLAN configuration is a network-side change that should come after verifying the local initiator service, and the network team already confirmed no changes. Option B is wrong because replacing cables is a physical intervention that is premature without first checking the initiator service status. Option D is wrong because reconfiguring the server's IP address is disruptive and unnecessary before verifying the initiator service and basic connectivity.

Practice this question →
24
MCQmedium

A server administrator is troubleshooting a Linux server that cannot reach any external websites, but internal resources are accessible. The administrator runs 'ip addr' and sees the correct IP address and subnet mask on eth0. Running 'ip route' shows no default route. What is the most likely cause?

A.The network interface is down.
B.The DNS server is unreachable.
C.The default gateway is not configured.
D.A firewall is blocking outbound traffic.
AnswerC

The 'ip route' output shows no default route, meaning the server lacks a gateway to reach external networks. Without a default route, the server can only communicate with hosts on its local subnet. Internal resources are accessible because they are on the same subnet, but external traffic fails. Configuring the default gateway resolves the issue.

Why this answer

The correct answer is that the default gateway is not configured. The 'ip route' output shows no default route, which is necessary to reach external networks. Internal resources are accessible because they are on the same subnet, but external traffic cannot be routed.

Configuring the default gateway restores external connectivity.

Exam trap

The trap here is assuming that DNS is the issue because users typically report 'cannot reach websites' as a name resolution problem, but the missing default route is the root cause.

Practice this question →
25
MCQeasy

After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?

A.Boot from a Windows recovery media and run chkdsk
B.Check the boot order in BIOS/UEFI
C.Reseat the failed drive and attempt to boot
D.Replace the failed drive and rebuild the array
AnswerB

Power loss can reset BIOS settings; verifying the boot order ensures the system looks for the OS on the correct drive.

Why this answer

Option C is correct because the system may be trying to boot from an incorrect device, especially after a power event may have reset BIOS settings. Option A is a later step if the array is truly broken. Option B is not the first step because the array itself may be bootable.

Option D is unlikely to restore a failed drive.

Practice this question →
26
MCQeasy

A server in the datacenter fails to power on after a scheduled power maintenance. The facility team confirms that power is being supplied to the rack. The server's front panel LED is not illuminated. Which of the following should the administrator check FIRST?

A.Reseat the CPU and memory modules.
B.Verify that the power cable is securely connected to the server and the PDU.
C.Replace the power supply unit.
D.Update the server's BIOS firmware.
AnswerB

With rack power confirmed and no front panel LED, the most likely fault is a disrupted connection between server and PDU. Reseating the power cable is the fastest, least invasive check before investigating PSUs, internal components or firmware.

Why this answer

The first step is to verify that the power cable is securely connected to both the server and the PDU. Since the facility team confirms power is supplied to the rack, the issue likely lies in the connection to the server. A loose cable would prevent power from reaching the server, resulting in no front panel LED.

This is a simple, non-invasive check that should be performed before replacing hardware or reseating components.

Exam trap

SK0-005 often tests the tendency to jump to hardware replacement (PSU) without first checking simple physical connections, leading candidates to overlook the most basic cause.

How to eliminate wrong answers

Option A is wrong because reseating CPU and memory is unnecessary and risky when the server shows no signs of power; it should be considered only after basic power checks. Option C is wrong because replacing the power supply unit is premature; the PSU might be fine if the cable is disconnected. Option D is wrong because updating BIOS firmware requires the server to be powered on and is irrelevant to a no-power condition.

Practice this question →
27
MCQhard

A server administrator is troubleshooting a RAID 5 array that has suddenly become degraded. The array consists of four SAS drives. The administrator runs the RAID controller management utility and sees that one drive has failed. After replacing the failed drive, the rebuild process starts but stalls at 20%. The administrator checks the event log and sees numerous medium errors on another drive. What should the administrator do next?

A.Back up critical data immediately before taking further action.
B.Restart the server to reset the RAID controller and resume the rebuild.
C.Force the rebuild to complete by setting the drive with medium errors offline.
D.Replace the drive with medium errors and allow the rebuild to continue.
AnswerA

In a degraded RAID 5 array with a second drive showing medium errors, the array is at high risk of total failure. Backing up critical data is the first priority to prevent data loss. The rebuild is stalled, and another drive is unreliable; if that drive fails during rebuild, data will be lost. A backup ensures data can be restored if the array fails.

Why this answer

A degraded RAID 5 array with a second drive showing medium errors is in a precarious state. The rebuild is stalled, and another drive failure could cause data loss. The immediate priority is to back up critical data.

Only after a backup should the administrator attempt to replace the problematic drive or take other corrective actions, ensuring data can be restored if the array fails completely.

Exam trap

The trap here is focusing on fixing the RAID array immediately without first ensuring data is backed up, risking total data loss if another drive fails during the rebuild.

Practice this question →
28
MCQeasy

A server administrator is troubleshooting an issue where a database server's performance degrades every night at 2 AM. Resource monitor shows high disk I/O and CPU usage during that time. There are no scheduled tasks on the server. Which of the following should the administrator investigate FIRST?

A.Network congestion from backups
B.Disk defragmentation tasks
C.A cron job misconfiguration
D.Scheduled antivirus scans on the server
AnswerD

Many antivirus solutions have a default scan schedule; even without local tasks, managed scans can run at 2 AM and heavily use disk and CPU.

Why this answer

Option A is correct because centrally managed antivirus software may perform scans at a default time, causing high resource usage. Option B would result in network utilization, not local disk I/O. Option C is possible but typically scheduled and would appear in the task scheduler.

Option D contradicts the statement that no scheduled tasks exist.

Practice this question →
29
Multi-Selectmedium

A server administrator is troubleshooting a physical server that emits a continuous amber health LED and whose operating system logs show correctable memory errors increasing on one DIMM slot. The server is still running production workloads. Which of the following actions should the administrator take? (Choose two.)

Select 2 answers
A.Run a full memory diagnostic such as memtest86+ or the vendor's offline diagnostics before replacement
B.Move the DIMM to a different slot and continue running without diagnostics
C.Schedule a maintenance window and replace the DIMM in the flagged slot
D.Increase the memory clock speed to improve error correction throughput
E.Disable ECC in the BIOS so the correctable errors stop being logged
AnswersA, C

An offline diagnostic confirms which module is failing and rules out a slot or controller issue before parts are ordered or the server is opened. It also verifies that other DIMMs are healthy so the maintenance window addresses all affected modules at once. This validation step reduces the chance of a repeat failure after replacement.

Why this answer

Correctable memory errors climbing on one DIMM signal a degrading module that should be validated and replaced. Running offline diagnostics confirms the faulty part and checks the remaining modules, while replacing the DIMM during a maintenance window removes the root cause before errors become uncorrectable and threaten production. Suppressing, relocating, or overclocking the memory leaves the failing hardware in service.

Exam trap

The trap here is silencing the amber LED or the log entries by disabling ECC or moving the DIMM, rather than treating escalating correctable errors as a hardware failure that must be replaced.

Practice this question →
30
MCQhard

A server uses NIC teaming with LACP (802.3ad) for load balancing and failover. After replacing a failed switch with a new switch of the same model, the server loses network connectivity. The switch ports show no activity. Which of the following is the MOST likely cause?

A.The switch ports are not configured as access ports.
B.The new switch has a different firmware version.
C.The server's NIC teaming mode is set to active/passive.
D.LACP is not enabled on the switch ports.
AnswerD

LACP requires configuration on the switch; default is no LACP, so the switch does not negotiate the port-channel, leading to no connectivity.

Why this answer

LACP must be explicitly enabled and configured on switch ports to form a port-channel (Option D). New switches ship with default configurations that do not include LACP. The server's NIC teaming mode (Option A) was previously working, so it is likely correct.

Access port configuration (Option B) would affect VLAN membership but not completely drop traffic. Firmware differences (Option C) rarely cause total loss of connectivity without other configuration mismatches.

Practice this question →
31
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 host that fails to apply a monthly cumulative update. Windows Update returns error 0x800f0922, and the C: volume has 30 GB free while the System Reserved partition has only 12 MB free. Which of the following is the MOST likely cause?

A.The cumulative update is incompatible with the installed .NET Framework version.
B.The server's antivirus software is blocking the update package.
C.The System Reserved partition lacks sufficient free space for the update to stage its files.
D.The Windows Update service is disabled on the server.
AnswerC

Error 0x800f0922 commonly occurs when the small System Reserved or EFI System Partition cannot accommodate the update's staging requirements, and 12 MB is far below the typical headroom needed. The large amount of free space on C: rules out general disk exhaustion. Extending or cleaning the reserved partition resolves the failure.

Why this answer

Error 0x800f0922 during cumulative update installation is strongly associated with insufficient free space on the System Reserved or EFI System Partition, which the update uses to stage files. With only 12 MB free on that partition and ample space on C:, the reserved partition is the bottleneck. Freeing or extending it allows the update to complete.

Exam trap

The trap here is focusing on the large C: volume's free space and overlooking that cumulative updates also stage files on the small System Reserved or EFI partition, which is the actual constraint.

Practice this question →
32
MCQhard

A server administrator is troubleshooting a Windows Server 2019 that periodically loses network connectivity. The server has two teamed network adapters in switch-independent mode. Users report intermittent access to file shares. The administrator runs `Get-NetLbfoTeam` and sees the team status is 'Degraded'. Which of the following is the MOST likely cause?

A.One of the physical adapters in the team has failed or is disconnected.
B.The switch ports for both adapters are configured with different VLANs.
C.The NIC teaming mode is set to switch-dependent, causing a configuration conflict.
D.The server's TCP/IP stack is corrupted, requiring a reset.
AnswerA

A degraded NIC team status in Windows Server typically indicates that one or more member adapters are not functioning. This could be due to a failed adapter, a disconnected cable, or a switch port issue. The remaining adapter may still pass traffic, but redundancy is lost, and intermittent connectivity can occur if the active adapter is overwhelmed or if failover events happen.

Why this answer

The 'Degraded' status of a Windows NIC team indicates that at least one member adapter is not operational. This commonly results from a failed adapter, unplugged cable, or switch port issue. The team continues to function with remaining adapters but loses redundancy and may experience intermittent connectivity.

Checking physical connections, adapter status in Device Manager, and switch port statistics will confirm the cause. Other options do not directly explain the degraded state.

Exam trap

The trap here is focusing on logical configuration like VLANs or TCP/IP when the team status points to a physical adapter problem.

Practice this question →
33
MCQeasy

A server administrator is troubleshooting a server that is emitting a continuous beeping sound. The server is powered on but does not display any video. The administrator checks the server's documentation and finds that the beep code indicates a memory error. Which of the following should the administrator do FIRST?

A.Reseat the memory modules and test one at a time.
B.Update the BIOS to the latest version.
C.Replace all memory modules with new ones.
D.Check the power supply voltages with a multimeter.
AnswerA

Reseating memory modules can resolve issues caused by poor contact, and testing one module at a time helps isolate a faulty DIMM. This is a non-destructive first step that directly addresses the indicated memory error. It is also cost-effective and quick to perform before considering replacements or more complex diagnostics.

Why this answer

The correct answer is to reseat the memory modules and test one at a time. This approach is methodical and addresses the most likely causes of a memory error: poor contact or a single faulty DIMM. It is a quick, non-destructive step that can often resolve the issue without replacing hardware.

Only if this fails should more advanced steps be taken.

Exam trap

The trap here is jumping to replace all memory or update BIOS when a simple reseat and isolation test is the appropriate first action.

Practice this question →
34
MCQmedium

A server administrator receives alerts that a file server's system volume is nearly full. The administrator runs a disk usage report and finds that a single log directory contains millions of small files consuming most of the free space. Users need the server to remain online while the issue is resolved. Which of the following should the administrator do to reclaim space with the LEAST disruption?

A.Extend the system volume by adding a disk to the existing array and expanding the partition online
B.Perform an online defragmentation of the system volume to consolidate the small files
C.Archive or rotate the log files to another volume and delete or compress the older logs
D.Run a full antivirus scan on the volume to remove infected files and quarantine them
AnswerC

Moving older logs to another volume and removing or compressing them directly reclaims space on the system volume without taking the server offline or disrupting users. This addresses the identified cause, the accumulation of millions of small files, and can be performed while the server remains in service. It is the least disruptive effective remedy for the capacity shortfall.

Why this answer

The disk usage report identifies millions of accumulated log files as the cause of the near-full volume, so the direct, low-impact remedy is to archive or rotate those logs to another volume and remove or compress the old ones. This reclaims space immediately without taking the server offline or disrupting users, unlike scanning, defragmenting, or expanding the volume, which do not address the root cause.

Exam trap

The trap here is reaching for storage expansion or maintenance operations when the immediate problem is an accumulation of files that can simply be relocated or deleted online.

Practice this question →
35
MCQhard

A server administrator is troubleshooting a server that fails to boot after a firmware update. The server powers on, completes POST, but then displays a message indicating no bootable device found. The administrator confirms the RAID controller is detected and the drives are online. What is the most likely cause?

A.The operating system boot files are corrupted.
B.The boot order in the UEFI/BIOS was reset during the firmware update.
C.The RAID array is degraded and needs to be rebuilt.
D.The firmware update failed and corrupted the RAID controller.
AnswerB

Firmware updates can reset UEFI/BIOS settings to defaults, including boot order. If the boot order no longer includes the RAID volume or the correct device, the server will report no bootable device. Since the RAID controller and drives are online, the data is intact. Reconfiguring the boot order to prioritize the RAID volume resolves the issue.

Why this answer

The correct answer is that the boot order in the UEFI/BIOS was reset during the firmware update. Firmware updates often reset BIOS settings to defaults, which can remove the RAID volume from the boot order. Since the RAID controller and drives are online, the data is safe.

Reconfiguring the boot order restores bootability.

Exam trap

The trap here is assuming data loss or corruption, but the drives are online and the controller is detected, so the issue is configuration, not hardware failure.

Practice this question →
36
MCQhard

A server administrator is troubleshooting a Windows Server 2019 host whose local volumes suddenly show as RAW in Disk Management after a storage controller firmware update. The volumes were NTFS and contained production data. Which of the following actions should the administrator take FIRST?

A.Immediately reformat the volumes as NTFS to restore service
B.Capture a sector-level image of each affected disk before attempting any repair
C.Run chkdsk /f on each affected volume to repair the file system
D.Roll back the controller firmware and reboot to see if the volumes return
AnswerB

Imaging the disks first preserves the exact on-disk state, so any subsequent repair or recovery attempt can be repeated or reversed without further risk. Because the volumes turned RAW right after a firmware update, the data is probably intact and the issue may be metadata interpretation or controller configuration. Working from an image protects the original evidence.

Why this answer

When volumes unexpectedly appear as RAW after a controller firmware change, the priority is preserving the current disk state. A sector-level image captures everything before any write occurs, so repair, rollback, or third-party recovery can proceed safely. Repair tools, formatting, and even a firmware rollback all risk modifying the disks, so imaging must come first.

Exam trap

The trap here is treating RAW as ordinary corruption and running chkdsk or reformatting, when the correct first move is to preserve the disks because the data may still be fully recoverable.

Practice this question →
37
MCQmedium

A server administrator is troubleshooting a newly installed 2U server that powers on but does not complete POST. The server emits a repeating beep code and no video output appears. The administrator has already reseated the memory modules and verified that the power supplies are fully seated and the power LEDs are green. Which of the following should the administrator check NEXT?

A.Replace the CMOS battery and clear the NVRAM using the motherboard jumper.
B.Verify that the CPU is properly seated in its socket and that the heatsink is making full contact.
C.Check the front panel USB and video cables for proper connection to the motherboard.
D.Update the BIOS firmware to the latest version using the vendor's update utility.
AnswerB

A repeating beep code with no video on a new build commonly indicates a CPU or socket issue. If the processor is not fully seated or the heatsink is not making proper contact, the system may halt before POST completes. Checking CPU seating and heatsink contact is a logical next step after memory and power have been ruled out.

Why this answer

After ruling out memory and power, a repeating beep code with no POST on a new server strongly suggests the CPU is not properly seated or the heatsink is not making full contact. Many motherboards emit a specific beep pattern for CPU errors. Verifying CPU installation and heatsink contact is the next logical hardware check.

Exam trap

The trap here is assuming that a no-POST condition with beep codes always points to memory, even after memory has been reseated and verified.

Practice this question →
38
Multi-Selectmedium

A server administrator is troubleshooting intermittent network connectivity issues on a server. Users report that connections to the server sometimes time out, and the administrator notices that the server's link LED on the switch occasionally goes dark. The administrator has already replaced the patch cable from the server to the wall jack. Which of the following should the administrator check NEXT? (Choose two.)

Select 2 answers
A.Verify the integrity of the structured cabling between the wall jack and the patch panel.
B.Update the NIC driver to the latest version from the vendor's website.
C.Reconfigure the switch port to use a fixed speed and duplex instead of auto-negotiation.
D.Check the switch port for errors, duplex mismatches, or flapping using the switch's management interface.
E.Replace the server's network interface card with a known-good spare.
AnswersA, D

Intermittent link loss after replacing the patch cable often indicates a problem in the permanent link, such as a damaged or poorly terminated cable between the wall jack and patch panel. Testing or certifying this segment can reveal opens, shorts, or high attenuation that cause intermittent connectivity. This is a logical next step in isolating the fault.

Why this answer

Intermittent link loss after replacing the patch cable points to the structured cabling or the switch port. Checking the permanent link between the wall jack and patch panel, and reviewing switch port statistics for errors or flapping, are the next logical diagnostic steps to isolate the fault.

Exam trap

The trap here is assuming the NIC or driver is at fault when the link LED on the switch is going dark, which indicates a physical layer issue rather than a software or NIC problem.

Practice this question →
39
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 file server that intermittently becomes unreachable on the network for 30-60 seconds at a time. Event Viewer shows repeated Netlogon 5719 errors stating that no domain controller is available, and the network team confirms no switch or router outages. The server has two teamed NICs. Which of the following should the administrator check FIRST to resolve this issue?

A.Replace both network interface cards in the team because intermittent link failures indicate failing hardware.
B.Rebuild the Netlogon secure channel by resetting the computer account password with netdom or Test-ComputerSecureChannel.
C.Disable the NIC team and configure a single adapter to eliminate teaming as a possible cause.
D.Verify the DNS server addresses configured on the server and confirm the domain controller records resolve correctly.
AnswerD

Netlogon 5719 with no network outages typically indicates the server cannot locate a domain controller through DNS, so validating the configured DNS servers and confirming the SRV and A records for the domain controllers resolve correctly is the most direct first step to isolate the failure.

Why this answer

Intermittent Netlogon 5719 errors with confirmed network stability almost always trace back to name resolution or domain-locator configuration. Checking the DNS servers and confirming domain controller SRV records resolve correctly identifies whether the server can find a domain controller at all, which is the fastest path to a definitive diagnosis.

Exam trap

The trap here is assuming that a network reachability symptom must be a physical or switching problem, when the underlying cause is actually DNS-based domain controller location.

Practice this question →
40
MCQmedium

After installing additional RAM modules in a server, the BIOS displays only a portion of the installed memory. The modules are identical in speed and size but from different manufacturers. Which of the following is the BEST initial troubleshooting step?

A.Replace the motherboard.
B.Run memtest86 immediately.
C.Reseat all memory modules and ensure proper slot population.
D.Update the server BIOS firmware.
AnswerC

This addresses the most common cause of unrecognized memory: poor connections or incorrect order of slots.

Why this answer

Reseating memory and checking population order (Option C) are the first steps because improper seating or incorrect slot placement can cause the BIOS to not recognize all modules. Updating BIOS (Option A) might help if a compatibility issue exists, but physical inspection should come first. Replacing the motherboard (Option B) is too extreme.

Running memtest86 (Option D) is useful but should follow physical checks.

Practice this question →
41
Multi-Selectmedium

A server administrator is troubleshooting a physical server that reports a predictive failure on a drive in a hardware RAID 5 array. The array is still online and functioning. The administrator wants to replace the failing drive while minimizing risk to the data. Which of the following steps should the administrator perform? (Choose two.)

Select 2 answers
A.Delete the array and recreate it from scratch to ensure a clean rebuild.
B.Force the failing drive offline immediately so the controller begins rebuilding onto a spare.
C.Identify the physical bay of the failing drive using the RAID controller management utility or locator LED before removal.
D.Power down the server and remove the drive while the system is offline to avoid hot-swap risk.
E.Verify a current, tested backup of the array data exists before beginning the replacement.
AnswersC, E

Pulling the wrong drive from a RAID 5 array causes an immediate data-loss event because two members would be missing. Using the controller utility or the bay's locator LED to positively identify the degraded member ensures the correct physical drive is removed and preserves array integrity.

Why this answer

Replacing a member of a degraded RAID 5 array safely requires two things: a validated backup in case the rebuild fails or another drive dies, and positive identification of the correct physical bay so the wrong drive is never removed. Both steps directly reduce the risk of catastrophic data loss during the swap.

Exam trap

The trap here is treating a predictive failure as harmless because the array is still online, and skipping backup verification or bay identification before pulling a drive.

Practice this question →
42
MCQmedium

Refer to the exhibit. What is the most likely cause of this error?

A.The boot order is set incorrectly
B.The hard drive data cable is loose
C.The boot sector is corrupted
D.The hard drive has failed
AnswerA

An incorrect boot order causes the firmware to attempt a non-bootable device first, producing the 'no boot device' error shown. This satisfies the exhibit's symptom, since the operating system is present but the firmware never reaches the correct disk.

Why this answer

The error 'Boot device not found' with 'Hard Disk: (3F0)' indicates the BIOS cannot find a bootable device. The most common cause is an incorrect boot order, where the system is trying to boot from a non-bootable device before the hard drive. A corrupt boot sector would give a different error (e.g., 'Missing operating system').

A loose cable could cause the drive not to be detected at all, but often the system would show no hard drive in BIOS. A failed drive would typically be detected but unbootable.

Practice this question →
43
MCQhard

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server sometimes time out, and the administrator notices that `ifconfig` shows a high number of dropped packets on the `eth0` interface. The switch port is configured for 1 Gbps full duplex. Which of the following is the MOST likely cause?

A.The switch port is configured for jumbo frames, but the server NIC is not.
B.The network interface card (NIC) is configured for half duplex due to autonegotiation failure.
C.The Ethernet cable is faulty and needs to be replaced.
D.The NIC driver is outdated and needs to be updated.
AnswerB

A duplex mismatch between the NIC and switch (e.g., NIC at half duplex, switch at full duplex) causes collisions and dropped packets. The switch port is set to full duplex, so if the NIC autonegotiates to half duplex, performance degrades and packet loss occurs. This is a classic cause of intermittent connectivity and high drop counts.

Why this answer

A duplex mismatch between the NIC and switch causes collisions and dropped packets, leading to intermittent connectivity issues. The switch port is set to full duplex, so if the NIC is at half duplex, performance suffers. The correct answer identifies this mismatch.

Exam trap

The trap here is overlooking the switch configuration and assuming a hardware failure; duplex mismatch is a frequent cause of such symptoms.

Practice this question →
44
MCQmedium

A technician is troubleshooting a server that fails to boot. The server displays a 'Boot Device Not Found' error. The technician verifies that the hard drives are spinning and appear in the RAID controller's BIOS. What should the technician check next?

A.Boot order in BIOS
B.Operating system files
C.SATA cable connections
D.RAID array status
AnswerA

With drives detected by the RAID controller, the failure lies in the boot sequence rather than hardware. Checking the BIOS boot order confirms whether the correct logical volume or device is listed first, resolving the 'Boot Device Not Found' error.

Why this answer

When a server reports 'Boot Device Not Found' but the drives are detected by the RAID controller, the most likely cause is that the BIOS/UEFI boot order does not list the RAID logical volume (or the correct device) as a boot option. The firmware is looking at the wrong device or has lost the boot entry. Checking and correcting the boot order is the logical next step before assuming OS or hardware failure.

Exam trap

SK0-005 often tests the tendency to jump to hardware or OS causes when the error message explicitly indicates the firmware cannot find a boot device—candidates overlook the simple BIOS boot order check.

How to eliminate wrong answers

Option B is wrong because if the OS files were corrupted, the server would typically find the boot device and then fail with a bootloader or OS error, not 'Boot Device Not Found.' Option C is wrong because the drives are already visible in the RAID controller BIOS, which confirms the physical SATA/SAS connections are working. Option D is wrong because a degraded RAID array would still usually present a bootable volume (unless it is failed), and the error would more likely be a RAID failure message—plus the question states drives are spinning and visible.

Practice this question →
45
MCQmedium

A server administrator is troubleshooting a server that intermittently fails to boot and occasionally displays a 'CMOS checksum error' during POST. The server's clock also resets to an old date after each power cycle. The administrator has already verified that the power supply is functioning and that all internal cables are securely connected. Which of the following is the MOST likely cause of these symptoms?

A.The power supply unit is failing to provide stable voltage.
B.The server's RAM modules are faulty and causing POST errors.
C.The motherboard's BIOS firmware is corrupted and requires reflashing.
D.The CMOS battery on the motherboard is depleted.
AnswerD

A depleted CMOS battery cannot maintain the real-time clock and BIOS settings when the server is powered off. This leads to clock resets and checksum errors because the stored configuration is lost. Replacing the battery is the standard fix. The other options do not explain the loss of time and settings.

Why this answer

The symptoms of a clock resetting and CMOS checksum errors point directly to a depleted CMOS battery. This battery maintains the real-time clock and BIOS settings when the server is unplugged. Without it, settings are lost on power-off, causing the observed errors.

The other options do not account for the loss of time and configuration data.

Exam trap

The trap here is assuming that intermittent boot failures always indicate a power supply or RAM issue, while overlooking the specific clock and CMOS error symptoms that uniquely point to the CMOS battery.

Practice this question →
46
MCQmedium

A server administrator runs a Linux server hosting a MariaDB database. Users report that the database is extremely slow. The administrator runs top and sees a load average of 45 on a system with 4 CPU cores, and %iowait is consistently above 80%. Which command should the administrator run next to identify the specific storage device causing the bottleneck?

A.iostat -x 2
B.vmstat 2
C.sar -n DEV 2
D.netstat -i 2
AnswerA

iostat -x provides extended statistics per block device, including %util, await, and svctm, which reveal which disk is saturated. With high %iowait and load average, this identifies the specific device causing the bottleneck, enabling targeted remediation such as moving the database to faster storage or rebalancing I/O.

Why this answer

The high load average and %iowait indicate a storage bottleneck. To resolve the issue, the administrator must identify the specific disk causing the saturation. iostat -x provides per-device extended statistics, including %util and await, which pinpoint the bottleneck. Other tools like vmstat give system-wide I/O wait but lack per-device detail, while network-focused commands are irrelevant here.

Exam trap

The trap here is assuming that vmstat or top provides enough detail to identify the specific disk, when only per-device tools like iostat can reveal the exact bottleneck.

Practice this question →
47
MCQhard

A server running a critical database application crashes and fails to boot with the error message 'Operating System not found.' The server is equipped with a hardware RAID 5 array consisting of three identical disks. A technician suspects a disk failure. What is the MOST likely cause of this error?

A.A single disk has experienced a complete failure.
B.The boot sector on the disk is corrupted.
C.The RAID controller firmware is corrupted.
D.Two or more disks have failed.
AnswerD

RAID 5 tolerates exactly one disk failure; with two or more disks failed, the array loses parity and cannot reconstruct data, so the boot volume becomes unreadable and the firmware reports no operating system. This directly explains the 'Operating System not found' error given three disks in the array.

Why this answer

Option D is correct because RAID 5 can tolerate a single disk failure and continue operating in a degraded state. The 'Operating System not found' message indicates the RAID array is offline or the boot volume is inaccessible, which most commonly happens when two or more disks fail simultaneously, exceeding the redundancy of RAID 5. Option A would not cause this error; a single failure would allow the OS to boot.

Option C is less common and might produce different errors. Option B could happen but is normally a second-order effect.

Practice this question →
48
MCQeasy

A technician is troubleshooting a server that powers on but produces no video output and emits a repeating beep code. The server's documentation indicates the pattern corresponds to a memory error. The technician has already reseated the existing DIMMs and verified the slots are clean. Which of the following should the technician do NEXT?

A.Update the system firmware to the latest revision from the vendor.
B.Clear the CMOS and reconfigure the BIOS memory timings to default values.
C.Install a known-good DIMM in the first populated slot and retest the system.
D.Replace the motherboard because the memory controller is integrated into the chipset.
AnswerC

Substituting a known-good module isolates whether the fault follows the DIMM or stays with the slot or board. This is the logical next diagnostic step after reseating, because it distinguishes a failed memory module from a defective slot or memory controller without replacing major components.

Why this answer

After reseating and cleaning, the fastest way to determine whether the fault is the module itself or the slot and board is to install a known-good DIMM in the primary slot. If the system POSTs, the original module is faulty; if it still beeps, the slot or board is implicated.

Exam trap

The trap here is jumping to a motherboard replacement when the beep code has not yet been proven to follow the DIMM rather than the slot.

Practice this question →
49
MCQeasy

A server administrator notices that a database server is responding slowly to queries. The CPU utilization is at 30%, memory at 40%, and disk latency is normal. Which of the following should the administrator check NEXT?

A.Network bandwidth utilization
B.Power supply status
C.Database index fragmentation
D.Operating system patch level
AnswerA

With CPU, memory and disk latency all healthy, the bottleneck lies elsewhere. Checking network bandwidth utilisation reveals whether saturated links or packet loss are delaying query responses between the database server and its clients, which is the remaining resource constraint the stem leaves unexamined.

Why this answer

Network bandwidth utilization should be checked next because high network usage can cause slow responses even when CPU, memory, and disk are fine.

Practice this question →
50
MCQhard

A server administrator is troubleshooting a Windows Server that is experiencing slow performance. The administrator runs Performance Monitor and notices that the 'Avg. Disk sec/Transfer' counter is consistently above 25 ms. Which of the following is the MOST likely cause?

A.The server has insufficient RAM, causing excessive paging.
B.The CPU is overloaded, causing delays in processing disk I/O requests.
C.The network adapter is causing retransmissions, slowing down disk access.
D.The disk subsystem is experiencing a bottleneck due to high latency.
AnswerD

The 'Avg. Disk sec/Transfer' counter measures the average time it takes to complete a disk transfer. Values above 25 ms indicate significant latency, often pointing to a storage bottleneck. This could be due to slow disks, a failing drive, or excessive load. Addressing the disk subsystem, such as upgrading to SSDs or redistributing load, is necessary to improve performance.

Why this answer

The 'Avg. Disk sec/Transfer' counter in Performance Monitor measures disk latency. Values above 25 ms indicate a storage bottleneck, where the disk subsystem cannot keep up with I/O requests.

This can be caused by slow physical disks, RAID degradation, or excessive load. Troubleshooting should focus on the storage layer, such as checking disk health, optimizing RAID configuration, or moving to faster storage. Memory, CPU, and network issues would not directly cause this specific counter to spike.

Exam trap

The trap here is attributing high disk latency to memory or CPU problems instead of recognizing it as a storage subsystem bottleneck.

Practice this question →
51
MCQmedium

A server administrator is diagnosing a Windows Server 2019 server that reboots unexpectedly about once a day. Windows Event Viewer shows Event ID 6008 (unexpected shutdown) and a BugCheck entry with stop code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA). The server has 512 GB of RAM and the page file is system-managed. Which tool should the administrator use to analyze the memory dump and identify the faulty driver?

A.Performance Monitor with the Memory\Pool Nonpaged Bytes counter
B.Resource Monitor's Memory tab to inspect hard faults per second
C.System Configuration (msconfig) to perform a diagnostic startup
D.WinDbg with the !analyze -v command against the MEMORY.DMP file
AnswerD

WinDbg is the Microsoft debugging tool that reads the kernel memory dump and the !analyze -v extension pinpoints the faulting module, stack, and driver behind stop code 0x00000050. This directly identifies the faulty driver, which the administrator needs to update or remove. It is the correct tool for post-crash kernel dump analysis on Windows Server.

Why this answer

The stop code 0x00000050 indicates a page fault in nonpaged pool, and Windows has captured a kernel dump. WinDbg with the !analyze -v command parses that dump, resolves the call stack, and names the faulting driver. Performance Monitor and Resource Monitor are live-monitoring tools, while msconfig is an isolation method; none analyze dump files.

The administrator needs the exact driver to remediate the recurring bugcheck.

Exam trap

The trap here is assuming that live performance tools can analyze a crash dump, when dump parsing requires a debugger such as WinDbg.

Practice this question →
52
MCQmedium

A server administrator is troubleshooting a newly racked server that powers on but does not POST. The server's front-panel status LED shows a steady amber condition, and no video signal is produced. The administrator has already confirmed that both power supplies are connected to working PDUs and that the power button is not faulty. Which of the following should the administrator check NEXT?

A.Replace the system board battery (CMOS battery).
B.Reseat the CPU and apply fresh thermal paste.
C.Connect a serial console to check for BIOS output.
D.Verify that the memory modules are fully seated and in the correct slots per the server documentation.
AnswerD

A steady amber status LED with no POST often points to a memory fault or misconfiguration. Memory not fully seated or installed in an unsupported slot population order is a common cause. Reseating and verifying slot population according to the vendor's guidelines is a logical next step before replacing components.

Why this answer

The steady amber status LED and lack of POST indicate a critical hardware fault, often memory-related. Verifying that memory modules are properly seated and populated according to the server documentation is a non-invasive, high-probability fix. Other options involve more invasive or less likely steps that should be deferred until basic hardware checks are completed.

Exam trap

The trap here is assuming that a no-POST condition always points to a failed CPU or motherboard, when memory seating or configuration is a more common and easily correctable cause.

Practice this question →
53
MCQhard

A database server with 64 GB of RAM and RAID 5 storage is experiencing intermittent performance degradation. System monitoring shows constant 95% memory utilization, high disk queue length, and frequent page faults. The server is running a critical application that cannot be restarted during business hours. Which action will provide the BEST permanent resolution?

A.Replace the RAID 5 array with RAID 10
B.Move the page file to a dedicated SSD
C.Increase the size of the page file
D.Add more physical RAM
AnswerD

Constant 95% memory utilisation with frequent page faults indicates the working set exceeds 64 GB, forcing disk paging that inflates queue length. Adding physical RAM removes the paging bottleneck permanently without restarting the critical application during business hours.

Why this answer

High memory utilization combined with frequent page faults indicates a memory bottleneck. Adding physical RAM eliminates the need for paging, permanently resolving the root cause. Increasing or moving the page file only mitigates the symptoms, while replacing RAID 5 with RAID 10 improves disk performance but does not address the underlying memory shortage.

Practice this question →
54
PBQmedium

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

A.Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.
B.Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.
C.Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.
D.Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.
AnswerC

Why this answer

Option C is correct because the symptoms as confirmed by the switch log show that each link flap triggers spanning-tree recalculation, causing the port to cycle through listening and learning states before forwarding resumes. Enabling PortFast on switch ports that are connected to end devices (like ESXi hosts) allows immediate forwarding. Option A is wrong because changing to access mode would break multiple VLANs and still face STP delays.

Option B is wrong because disabling notify switches might worsen MAC table inconsistencies. Option D is wrong because changing load balancing does not stop the flapping or STP convergence; the issue is at layer 2.

Practice this question →
55
MCQeasy

A server administrator is troubleshooting a rack server that fails to complete POST. The server emits a series of beep codes, and no video output appears. The administrator has already reseated the memory modules and confirmed they are in the correct slots. Which of the following should the administrator check NEXT?

A.The CMOS battery voltage
B.The power supply output voltages
C.The operating system boot loader configuration
D.The hard drive S.M.A.R.T. status
AnswerB

Beep codes with no video during POST often indicate a power delivery problem or a failed component. Checking the power supply output voltages with a multimeter or PSU tester confirms whether the PSU delivers stable rails. If voltages are out of tolerance, the system may fail POST before initializing video, matching the scenario.

Why this answer

Beep codes with no video output during POST indicate a hardware failure detected before video initialization. After confirming memory seating, the next logical check is power delivery, since unstable or out-of-tolerance PSU voltages can halt POST. CMOS battery, disk health, and boot loader configuration affect later stages and would not produce these symptoms.

Exam trap

The trap here is assuming any boot-related failure points to the operating system or storage, when the absence of video output means the failure occurs before the OS is even involved.

Practice this question →
56
MCQmedium

A server administrator is troubleshooting a tower server that reports no video output on the local monitor, but the power LED is solid green and the fans spin at normal speed. The administrator connects to the baseboard management controller (BMC) over the network and sees a POST code of 'B4' with a message indicating USB device initialization. A USB flash drive is left in a rear port. Which of the following is the MOST likely cause of the missing video?

A.The USB flash drive is causing the POST process to stall before video initialization completes.
B.The BMC is redirecting the video output to its remote console, so the local monitor stays blank.
C.The video card has failed and must be replaced before the server will POST.
D.The monitor cable is connected to the wrong port on the server.
AnswerA

The POST code 'B4' with a USB initialization message indicates the firmware is hung while enumerating USB devices. When POST stalls at this stage, video initialization may not complete, leaving the local monitor blank. Removing the flash drive and rebooting typically clears the hang. This matches the evidence of a solid power LED, normal fans, and a specific POST code.

Why this answer

The POST code 'B4' with a USB initialization message is the key evidence: the server is hanging during USB device enumeration, which can prevent video initialization from completing. Removing the offending USB flash drive and rebooting is the correct remediation. The other causes either contradict the POST code or would not produce that specific code.

Exam trap

The trap here is assuming no video always means a video subsystem failure, when a POST hang at USB enumeration is the actual cause.

Practice this question →
57
MCQmedium

A server administrator is troubleshooting a physical server that randomly crashes once or twice a week. The administrator has already verified that the power supply is functioning correctly and has checked the event logs for critical errors. According to standard troubleshooting methodology, what should the administrator do next?

A.Check network cables and switch connections.
B.Run memory diagnostics (e.g., MemTest86) to test RAM.
C.Reinstall the operating system.
D.Replace the CPU with a known good one.
AnswerB

With power and logs already cleared, memory is the prime suspect for intermittent crashes. MemTest86 exercises RAM outside the OS, exposing faulty modules that cause random reboots. This follows the methodology's next step: test the most probable remaining hardware cause before escalating.

Why this answer

After verifying power and checking event logs, the next logical step in standard troubleshooting methodology (CompTIA's six-step process) is to test the most likely remaining hardware cause of random crashes. Random crashes once or twice a week with no logged critical errors strongly suggest intermittent memory faults, which often do not produce OS-level event log entries. MemTest86 is the standard tool for testing RAM and is non-destructive, making it the correct next diagnostic step before escalating to more invasive actions.

Exam trap

SK0-005 often tests whether candidates jump to drastic fixes (OS reinstall, CPU replacement) instead of following the ordered troubleshooting methodology of testing the most likely and least invasive cause first, so the trap is selecting an aggressive action over a diagnostic one.

How to eliminate wrong answers

Option A is wrong because network cables and switch connections would cause connectivity issues, not random server crashes, and are unrelated to the symptom. Option C is wrong because reinstalling the operating system is a drastic, data-destructive action that should only be considered after hardware has been ruled out, and it violates the methodology of testing the most probable cause first. Option D is wrong because replacing the CPU is a much more invasive and expensive step than testing RAM, and CPUs fail far less often than memory; it should only be done after memory and other components are eliminated.

Practice this question →
58
MCQhard

Refer to the exhibit. A technician receives an alert from the monitoring system showing the error in the exhibit. The server is still online, but performance has degraded. Which of the following is the MOST likely cause and appropriate action?

A.The SATA controller driver is corrupted; reinstall the driver
B.The disk has a bad sector; run CHKDSK and monitor
C.The hard disk drive is failing; back up data and replace the drive
D.The disk is experiencing high I/O; upgrade to SSD
AnswerC

Controller errors on \Device\Harddisk0 typically mean the drive is failing. Backing up and replacing is the best course.

Why this answer

Event ID 11 from Disk source indicates a controller error, often due to a failing disk or cable. The most likely cause is a failing hard drive. Backing up and replacing the drive is the appropriate action.

Bad sectors might be the symptom but replacing is safer. Driver corruption is less likely; high I/O wouldn't cause a controller error.

Practice this question →
59
MCQhard

A RAID 5 array is degraded due to a failed disk. What is the best practice for recovery?

A.Replace the failed disk and restore from backup
B.Replace the failed disk and allow the array to rebuild automatically
C.Replace the failed disk and perform a manual rebuild from backup
D.Delete the logical drive and recreate the array
AnswerB

RAID 5 stores parity across remaining disks, so replacing the failed disk lets the controller reconstruct its contents automatically. This satisfies best practise by restoring redundancy without rebuilding the array from scratch or risking unnecessary data loss.

Why this answer

In a RAID 5 array, a single disk failure leaves the array degraded but still operational because parity data on the remaining disks can reconstruct the missing data. Best practice is to replace the failed disk and allow the controller to rebuild the array automatically from parity, restoring redundancy without downtime or data loss. This is the standard hot-swap recovery procedure and requires no backup restore because the data is still intact.

Exam trap

SK0-005 often tests whether candidates understand that RAID 5 tolerates one disk failure and rebuilds from parity, so the trap is choosing backup restore or array recreation when the correct action is simply replacing the disk and letting the controller rebuild.

How to eliminate wrong answers

Option A is wrong because restoring from backup is unnecessary when the array is only degraded — RAID 5 is designed to survive a single disk failure, and the data remains accessible via parity. Option C is wrong because a manual rebuild from backup is not how RAID recovery works; the controller rebuilds from parity, not from backup, and using backup would be slower and riskier. Option D is wrong because deleting and recreating the logical drive destroys all data on the array and is only appropriate when the array has failed beyond recovery (e.g., two disks failed in RAID 5).

Practice this question →
60
MCQhard

A server administrator is troubleshooting a Windows Server host that has been randomly losing connectivity to its iSCSI storage for the past week. The host has two dedicated NICs for iSCSI, each connected to a separate switch, and multipath I/O is configured. Event logs show intermittent path failures that recover within seconds. Switch port statistics show no errors, and both storage controllers report healthy. Which of the following should the administrator check FIRST to diagnose the intermittent path loss?

A.Replace the transceivers in both iSCSI NICs because intermittent link drops indicate failing optics
B.Confirm that the two iSCSI NICs are not participating in a team or spanning tree topology that introduces loops
C.Review the host's TCP retransmission and timeout settings, and check for network congestion on the storage VLAN
D.Verify that the iSCSI initiator and target are configured with matching CHAP authentication secrets
AnswerC

Intermittent iSCSI path failures that recover within seconds commonly result from dropped or delayed frames on the storage VLAN, causing TCP retransmissions and initiator timeouts. Checking retransmission counters, congestion, and timeout values on the dedicated storage network is the most direct way to confirm whether the storage VLAN is losing packets, which matches the self-healing behavior described.

Why this answer

Intermittent iSCSI path failures that recover within seconds, with clean switch port statistics and healthy storage controllers, point to packet loss or congestion on the storage network rather than a hardware fault. Reviewing TCP retransmission counters and timeout settings on the dedicated storage VLAN reveals whether frames are being dropped or delayed, which would cause the initiator to declare a path failed and then recover.

Exam trap

The trap here is treating intermittent storage path failures as a hardware problem and replacing components before examining network-level evidence such as retransmissions and congestion.

Practice this question →
61
Multi-Selecthard

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server occasionally time out, but the server responds to pings most of the time. The administrator suspects a duplex mismatch on the network interface. Which two commands should the administrator use to verify the current speed and duplex settings of the interface? (Choose two.)

Select 2 answers
A.ethtool eth0
B.ifconfig eth0
C.mii-tool eth0
D.ip -s link show eth0
E.netstat -i
AnswersA, C

ethtool eth0 displays the current link speed, duplex mode, and whether auto-negotiation is enabled for the interface. This directly provides the information needed to confirm a duplex mismatch. It is the standard Linux utility for querying and setting Ethernet card parameters, making it the correct choice for this scenario.

Why this answer

To confirm a duplex mismatch, the administrator needs to see the actual speed and duplex settings of the interface. ethtool and mii-tool both query the network interface card and report these parameters. The other commands provide statistics or IP configuration but not the negotiated duplex mode. Using either ethtool or mii-tool will reveal whether the interface is set to full or half duplex and at what speed.

Exam trap

The trap here is confusing interface statistics commands with link parameter commands; error counters suggest a problem but do not reveal duplex settings.

Practice this question →
62
MCQeasy

A server administrator is troubleshooting a server that is not responding to network requests. The server's link lights are on, and the switch port shows activity. The administrator cannot ping the server by IP address from another subnet, but can ping it from a host on the same subnet. What is the most likely cause?

A.The default gateway is misconfigured on the server.
B.The switch port is configured for the wrong VLAN.
C.A firewall on the server is blocking ICMP from remote subnets.
D.The server's NIC is faulty.
AnswerA

When a server can communicate with hosts on the same subnet but not from other subnets, the default gateway is likely incorrect or missing. The server uses the default gateway to route traffic outside its subnet. If the gateway is wrong, remote pings fail while local pings succeed. Verifying and correcting the gateway address resolves the issue.

Why this answer

The correct answer is that the default gateway is misconfigured on the server. The ability to ping locally but not remotely indicates a routing issue. The server can reach local hosts directly but needs a correct gateway to reach other subnets.

Checking and correcting the default gateway configuration restores connectivity.

Exam trap

The trap here is blaming the firewall or NIC, but the selective failure pattern (local works, remote fails) points directly to a gateway configuration error.

Practice this question →
63
MCQmedium

A server configured with RAID 5 has two failed drives. The array is offline and critical data is inaccessible. The administrator has replacement drives available. What should the administrator do to restore the data and array with minimal data loss?

A.Reconfigure the RAID to RAID 0 using the remaining good drives.
B.Replace both failed drives and initiate a full array rebuild.
C.Replace both failed drives and restore from backup.
D.Replace one failed drive, allow rebuild, then replace the second.
AnswerC

Dual drive failure in RAID 5 results in data loss; restoration from backup is required to recover data, and then the array can be recreated.

Why this answer

Option A is correct. RAID 5 can survive a single drive failure, but with two failed drives, the array is completely broken and cannot be rebuilt. Restoring from backup is the only reliable method to recover the data.

Options B and C incorrectly assume the array can still rebuild, and option D would worsen data integrity.

Practice this question →
64
MCQmedium

A server administrator is troubleshooting a server that is experiencing slow network performance. The server has a 10 GbE network interface card (NIC) connected to a switch port that is configured for 1 GbE. Which of the following is the MOST likely cause of the slow performance?

A.The network cable is Cat 5e, which cannot support 10 GbE.
B.The server's NIC driver is outdated and does not support 10 GbE.
C.The switch port is configured for 1 GbE, limiting throughput.
D.The NIC is set to half-duplex mode.
AnswerC

The switch port speed determines the maximum link speed. Even though the NIC supports 10 GbE, the connection will operate at 1 GbE, capping throughput at approximately 1 Gbps. This is a common cause of slow network performance when a high-speed NIC is connected to a lower-speed switch port. The administrator should verify the switch port configuration and ensure it matches the NIC's capabilities.

Why this answer

The correct answer is that the switch port is configured for 1 GbE, limiting throughput. When a 10 GbE NIC connects to a 1 GbE switch port, the link speed is negotiated at 1 GbE, capping performance. This is a straightforward configuration mismatch that can be resolved by reconfiguring the switch port to support higher speeds if the hardware allows.

Exam trap

The trap here is blaming the cable or driver when the obvious speed mismatch between the NIC and switch port is the actual bottleneck.

Practice this question →
65
MCQeasy

A server administrator is troubleshooting a network connectivity issue on a server that has recently been moved to a different rack. The server can ping its own IP address but cannot ping the default gateway. Which of the following is the MOST likely cause?

A.Faulty Ethernet cable or incorrect patch panel port
B.Incorrect DNS server configuration
C.Incorrect subnet mask
D.Duplicate IP address on the network
AnswerA

A physical connectivity issue at layer 1 can prevent the server from reaching the gateway while still allowing the NIC to respond to its own IP.

Why this answer

Option A is correct because being able to ping self but not gateway suggests a layer 1 or 2 issue like a faulty patch cable. Option B is wrong because DNS would affect name resolution, not ping. Option C is wrong because incorrect subnet mask would affect self-ping or gateway detection.

Option D is wrong because duplicate IP would cause intermittent issues or conflict messages.

Practice this question →
66
Multi-Selectmedium

A server administrator is troubleshooting a network connectivity issue where a newly installed server cannot communicate with other devices on the same subnet. The server has a static IP address configured. Other devices on the same switch can communicate. Which TWO of the following could be the cause of the issue? (Select TWO)

Select 2 answers
A.The DNS server address is incorrect.
B.The server's default gateway is incorrectly set.
C.The switch port is configured with port security and has learned a different MAC address.
D.Incorrect subnet mask configured on the server.
E.The DHCP server has exhausted its scope.
AnswersC, D

Port security configured to permit only specific MAC addresses will place the newly installed server's port in an errant or shutdown state when an unexpected MAC is learned, blocking all traffic. This explains why other devices on the same switch communicate normally while the new server cannot.

Why this answer

Option C is correct because if the switch port has port security enabled and has already learned a different MAC address, the switch will place the port in an err-disabled or violation state, blocking the newly installed server's traffic even though other devices on the switch communicate fine. Option D is correct because an incorrect subnet mask on the server can cause it to misjudge which addresses are local, so it may fail to ARP for or directly reach other devices on the same subnet, breaking same-subnet communication. Option A is not the cause because DNS only resolves hostnames to IP addresses and does not affect basic IP connectivity to devices on the same subnet.

Option B is not the cause because the default gateway is only used to reach remote subnets, not devices on the same local subnet. Option E is not the cause because the server uses a static IP address, so DHCP scope exhaustion would not prevent it from communicating.

Exam trap

SK0-005 often tests basic connectivity troubleshooting; candidates may overlook port security or subnet mask errors and incorrectly blame DNS or DHCP, which are not relevant for same-subnet static IP issues.

Practice this question →
67
MCQmedium

A server administrator is troubleshooting a Linux server that was working normally until a new kernel was installed. After rebooting, the server drops into a GRUB prompt instead of loading the operating system, and the administrator needs to restore normal boot as quickly as possible. Which of the following is the MOST appropriate action?

A.Reinstall the bootloader to the disk's master boot record or EFI system partition.
B.Regenerate the GRUB configuration file and verify the boot entries point to valid kernels.
C.Change the default boot target in systemd to multi-user.target and reboot.
D.Boot a rescue environment and rebuild the initramfs for the installed kernel.
AnswerB

Dropping to a GRUB prompt after a kernel installation commonly means the configuration file was not regenerated or references a kernel that no longer exists. Regenerating the GRUB configuration rebuilds valid menu entries against the kernels actually present, restoring normal boot. Verifying the entries confirms the correct kernel and root device are referenced before rebooting.

Why this answer

A system that stops at the GRUB prompt has a functioning bootloader but no valid menu entry to load, which frequently follows a kernel update that did not regenerate the configuration. Rebuilding the GRUB configuration restores entries tied to the kernels present on disk. Initramfs rebuilds, bootloader reinstalls, and systemd target changes each apply to different stages and would not fix this symptom.

Exam trap

The trap here is confusing the GRUB prompt with an initramfs or bootloader-installation failure, when the prompt itself proves GRUB is loaded and only its configuration is unusable.

Practice this question →
68
MCQhard

A server administrator is troubleshooting a Windows Server 2019 host that intermittently drops connections to a database application. The administrator reviews Performance Monitor and notices that the Network Interface\Output Queue Length counter for the production NIC frequently exceeds 2. The NIC is a 1GbE adapter, and the switch port is configured for 1GbE full duplex. Which of the following is the MOST likely cause?

A.An incorrect default gateway on the server
B.A duplex mismatch between the NIC and the switch port
C.A faulty network cable causing packet loss
D.The NIC is saturating its 1GbE link during peak database traffic
AnswerD

Output Queue Length counts packets queued in the network stack waiting for the adapter to transmit. Sustained values above 2 indicate the adapter cannot drain the queue fast enough, which happens when traffic approaches or exceeds the link capacity. On a 1GbE link carrying database traffic, saturation is the most likely cause of intermittent drops.

Why this answer

A sustained Network Interface\Output Queue Length above 2 means the OS send queue is backing up because the adapter cannot transmit fast enough. On a 1GbE link handling database traffic, link saturation is the most plausible explanation. Duplex mismatch, cable faults, and gateway errors produce different symptoms such as errors, link flaps, or routing failures.

Exam trap

The trap here is attributing intermittent network drops to physical layer faults like cables or duplex settings instead of recognizing a queue-length counter as evidence of bandwidth saturation.

Practice this question →
69
MCQmedium

A server administrator is troubleshooting a physical server that intermittently powers off without warning. The server is connected to a UPS, and the UPS logs show no recent power events. The administrator suspects a thermal issue. Which of the following should the administrator check FIRST to confirm this suspicion?

A.Check the operating system's event logs for unexpected shutdown entries.
B.Run a memory diagnostic to check for faulty RAM.
C.Review the IPMI/BMC system event log for thermal trip events.
D.Replace the power supplies one at a time to see if the issue persists.
AnswerC

The IPMI/BMC system event log records platform events such as thermal trips, fan failures, and temperature threshold crossings. Since the UPS shows no power issue, checking the BMC log for thermal events is the most direct way to confirm whether overheating is causing the shutdowns. This is a non-intrusive first step that can provide immediate evidence before physically inspecting the server.

Why this answer

The correct answer is to review the IPMI/BMC system event log for thermal trip events. This log captures hardware-level events, including temperature thresholds and fan failures, which are critical for diagnosing thermal shutdowns. Since the UPS shows no power anomalies, thermal causes are more likely, and the BMC log provides direct evidence without requiring physical intervention.

Exam trap

The trap here is assuming that a power-related symptom always indicates a power supply or UPS issue, when in fact thermal shutdowns can mimic power loss.

Practice this question →
70
MCQeasy

Refer to the exhibit. A Windows file server at a branch office lost network connectivity after a scheduled reboot. The administrator logs in via the console and runs `ipconfig /all`, which shows the output in the exhibit. The server should have a static IP of 10.0.0.50. What should the administrator do to restore connectivity?

A.Disable IPv6 on the network adapter.
B.The DHCP server is unreachable; check DHCP server availability.
C.Release and renew the DHCP lease.
D.Set a static IP configuration as intended.
AnswerD

The exhibit shows the adapter configured for DHCP, so it lacks the intended 10.0.0.50 address and cannot communicate. Assigning the static IP, mask, gateway and DNS manually restores the required configuration, resolving the connectivity loss.

Why this answer

The exhibit shows that the server's network adapter is configured to obtain an IP address automatically (DHCP), as indicated by 'DHCP Enabled: Yes' and an APIPA address of 169.254.x.x. Since the server should have a static IP of 10.0.0.50, the administrator must manually configure the static IP address, subnet mask, default gateway, and DNS servers. This will restore connectivity because the server will no longer rely on an unreachable DHCP server and will have the correct network configuration.

Exam trap

The trap here is that candidates might focus on the unreachable DHCP server (Option B) or attempt to release/renew the lease (Option C) because the exhibit shows DHCP enabled, but the key detail is that the server should have a static IP, so the correct action is to set it manually.

How to eliminate wrong answers

Option A is wrong because disabling IPv6 does not address the core issue; the server lacks a valid IPv4 configuration, and IPv6 is not causing the connectivity failure. Option B is wrong because while the DHCP server may be unreachable, the server is not supposed to use DHCP at all; the correct fix is to set a static IP, not to troubleshoot DHCP. Option C is wrong because releasing and renewing a DHCP lease would only attempt to obtain a new DHCP address, but the server requires a static IP, and the DHCP server is likely unreachable anyway.

Practice this question →
71
MCQmedium

A server cannot connect to a specific network share. The administrator can successfully ping the server's IP address from the client. Which of the following is MOST likely causing the issue?

A.Incorrect subnet mask
B.Duplicate IP address on the network
C.DNS server is misconfigured
D.Host-based firewall blocking file sharing ports
AnswerD

Correct — Firewalls often allow ICMP but block TCP/UDP ports used by SMB/CIFS, so ping succeeds but share access fails.

Why this answer

Option C is correct because Windows Firewall or an equivalent host-based firewall may block SMB (port 445) or NetBIOS ports, preventing share access even though ICMP is allowed. Option A is wrong because DNS would affect name resolution, not reachability by IP. Option B is wrong because an incorrect subnet mask would generally prevent any communication, including pings.

Option D is wrong because a duplicate IP would cause intermittent connectivity or an IP conflict error, not a consistent inability to access shares while ping works.

Practice this question →
72
MCQeasy

A server administrator is troubleshooting a server that fails to boot. The server powers on, completes POST, but then displays a message indicating that no bootable device is found. The administrator confirms that the BIOS/UEFI detects the hard drive. Which of the following should the administrator check FIRST?

A.The integrity of the operating system files.
B.The RAID controller configuration.
C.The physical connections of the hard drive.
D.The boot order in the BIOS/UEFI settings.
AnswerD

If the BIOS detects the hard drive but the server reports no bootable device, the boot order may be incorrect, causing the system to attempt booting from a non-bootable device like a network or optical drive. Checking and correcting the boot order is a quick and non-invasive first step.

Why this answer

When a server detects a hard drive but fails to boot with a no bootable device error, the boot order is the most likely culprit. The system may be trying to boot from a non-bootable device. Checking and adjusting the boot order in BIOS/UEFI is a quick first step.

Exam trap

The trap here is jumping to complex causes like OS corruption or RAID issues when a simple boot order misconfiguration is often the culprit.

Practice this question →
73
MCQhard

A server administrator is troubleshooting a Windows Server 2022 host that presents a RAID 10 array to the operating system as a single 2 TB volume. Users report that write performance to a database on this volume has degraded sharply over the past week, and the array's management utility shows all member drives as online with no rebuild in progress. Which of the following should the administrator check FIRST to identify the cause?

A.The NTFS cluster size of the volume presented to the operating system.
B.The RAID controller's write cache policy and battery/capacitor health status.
C.The number of spare drives assigned to the array.
D.The stripe size configured on the RAID 10 array.
AnswerB

A degraded write cache, whether disabled or backed by a failed battery or capacitor, forces write-through behavior and dramatically reduces write performance on a RAID 10 array. Because the member drives are healthy and no rebuild is occurring, the controller's cache state is the most likely explanation. Checking the policy and cache module health is the fastest way to confirm or rule out this cause.

Why this answer

With all RAID 10 member drives online and no rebuild activity, the sudden write slowdown most likely originates at the controller level. A failed cache battery or capacitor causes the controller to switch from write-back to write-through, which removes the performance benefit of the cache and sharply increases write latency. The cache policy and module health are therefore the first things to verify.

Exam trap

The trap here is chasing array geometry settings like stripe or cluster size when a sudden, recent write slowdown on healthy drives points to a controller cache state change rather than a configuration choice made at build time.

Practice this question →
74
MCQhard

A server running a critical application fails to boot with the error: 'Boot device not found.' The server uses UEFI and a RAID 5 array for the OS. The administrator verifies that all disks are present and powered. Which of the following should the administrator check FIRST?

A.The array configuration in the RAID BIOS
B.The integrity of the OS boot files
C.The boot order in UEFI
D.The RAID controller battery
AnswerA

Correct — The RAID setup utility will show if the array is degraded, offline, or missing, which is the most likely cause of the boot device error.

Why this answer

Option C is correct. With all disks powered and present, the RAID array may be degraded or its configuration lost, leading to the boot device error. Checking the array configuration in the RAID controller's BIOS (or UEFI setup) allows verifying that the array is intact and the boot volume is accessible.

Option A (RAID battery) is important for write cache but not directly causing 'boot device not found.' Option B (boot order) might be an issue, but after checking that the RAID array is operational; if the array is offline, boot order changes won't help. Option D (OS boot files) should be checked after ensuring the RAID subsystem is functional.

Practice this question →
75
Multi-Selecthard

Following a firmware update on a server's RAID controller, the server fails to boot and reports "No boot device found." The RAID array status shows healthy in the controller BIOS. Which THREE of the following actions should the administrator take to resolve the issue? (Choose three.)

Select 3 answers
A.Roll back the RAID controller firmware
B.Rebuild the RAID array from backup
C.Reset the RAID controller configuration to defaults
D.Verify the boot order in the system BIOS
E.Install the latest drivers for the RAID controller in the OS
AnswersA, C, D

If the new firmware caused the boot issue, rolling back to the previous version can restore functionality.

Why this answer

Options A, B, and E are correct. Rolling back firmware can undo a bad update. Verifying boot order ensures the correct device is first.

Resetting the controller configuration may clear incompatible settings from the update. Rebuilding the array is unnecessary as it is healthy. Installing OS drivers is impossible without a booted OS.

Practice this question →
Page 1 of 2 · 120 questions totalNext →

Ready to test yourself?

Try a timed practice session using only troubleshooting questions.

Start 20-question session