Performance-Based Questions (PBQs)

The ambient temperature sensor in the data center is reporting incorrectly and the actual temperature is higher.

Why wrong: Handheld thermometer confirms 20°C; other servers in same rack are fine, so ambient is normal.

The internal fans are not operating at full speed due to a failed fan controller.

Why wrong: Fans are verified spinning, and a fan controller failure would likely cause constant overheating or sensor errors, not just peak hours.

The file server's power supply is failing and causing voltage drops that affect fan performance.

Why wrong: A failing PSU typically causes power-related errors or system instability, not specific CPU thermal events; fans are verified operational.

Pay the ransom to decrypt the differential backup

Why wrong: Paying the ransom is not a recommended security practice and may not result in decryption.

Reinstall the operating system and restore files from cloud storage

Why wrong: There is no indication that cloud storage is available, and this would not utilize existing backups.

Restore using only Wednesday's differential backup

Why wrong: Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.

Buy a second external drive, alternate them, and keep one offsite at the owner’s house, rotating weekly.

Why wrong: A weekly rotation means the offsite drive contains data up to seven days old, which exceeds the one-day RPO, leading to unacceptable data loss in a disaster.

Purchase a network-attached storage device and configure it to receive daily backups; place it in a different room in the building.

Why wrong: An on-site NAS remains vulnerable to the same physical disaster (fire), so it does not provide offsite protection and data could still be lost.

Subscribe to a cloud backup service and perform daily incremental backups over the internet.

Why wrong: The firm's limited DSL bandwidth would make cloud backups slow and possibly fail to complete within the backup window; also, cloud services introduce recurring costs and complexity beyond their budget and skillset.

Pay the ransom demand to obtain the decryption key and decrypt both sites.

Why wrong: Paying ransoms encourages further attacks, provides no guarantee the key will work, and violates many regulatory and ethical standards for healthcare organizations.

Restore the most recent tape backup to the primary site and re-enable replication.

Why wrong: Restoring directly to the primary without first wiping the secondary could lead to re-encryption if the ransomware is not fully eradicated, and replication would propagate the encrypted data again.

Fail over to the secondary data center and attempt to decrypt the ransomware using available tools.

Why wrong: Modern ransomware typically uses strong encryption that cannot be broken without the key; publicly available tools rarely succeed, so this approach almost certainly fails to restore data.

Reboot HostB to renegotiate the network configuration.

Why wrong: Rebooting is a disruptive last resort; the issue is likely a static VLAN misconfig that a reboot won't fix unless the host's switch configuration is corrected.

Restart the vCenter Server service on the vCenter appliance.

Why wrong: vCenter manages the cluster but host networking is configured on each host; restarting vCenter does not change switch or host VLAN settings.

vMotion all affected VMs from HostB to HostA to confirm they work on HostA.

Why wrong: This would confirm the VMs are functional, but it does not fix HostB's networking and may not be possible if HostB's VM network is down.

Upgrade the tape library to use multiple tape drives for parallel backups and rotate tapes offsite daily

Why wrong: Parallel drives can improve speed but do not reduce the daily data volume; offsiting tapes is manual and risky.

Switch to synthetic full backups combined with incremental forever; store backups locally on disk

Why wrong: Synthetic fulls can reduce backup time but still require a full pass of changed data; offsite copy is not addressed.

Continue weekly fulls but perform daily incremental backups instead of differentials; keep tapes on-site

Why wrong: Incrementals would be faster but the full backup still takes 12 hours and offsite requirement is not met.

Reseat all memory modules and clean the DIMM slots

Why wrong: Reseating is a basic troubleshooting step, but multiple passes of MemTest86+ with no errors suggest the electrical connections are sound.

Replace the hard drives with solid-state drives (SSDs)

Why wrong: SSDs would improve I/O performance and reduce power draw slightly, but they would not correct the underlying power instability that is causing ECC memory errors.

Replace the motherboard, as the memory controller is likely failing

Why wrong: No evidence points to a motherboard memory controller failure; MemTest86+ passes, and corrected errors can be caused by power fluctuations.

Wait for the disk to completely fail so that the hot spare will automatically rebuild the array

Why wrong: This is risky because if another disk fails before the rebuild completes, the entire array could be lost.

Take a full backup immediately and then replace the disk during the next maintenance window

Why wrong: A backup protects data but does not restore redundancy; the array could still fail in the meantime.

Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later

Why wrong: Removing the disk intentionally degrades the array and may cause performance impact; using the hot spare directly is cleaner.

The new replacement drive is faulty.

Why wrong: If the new drive were faulty, the rebuild would likely have failed or shown errors.

The motherboard has a faulty PCIe slot for the RAID controller.

Why wrong: Faulty PCIe slot would cause the controller to disappear or cause I/O errors, not parity errors.

The RAID controller cache module has failed.

Why wrong: Cache failure would cause write errors or performance issues, not parity errors on a mirrored pair.

Move the server to a cooler location in the data center

Why wrong: The ambient temperature is within acceptable range, so moving the server would not significantly improve cooling.

Reinstall the CPU heat sink with more thermal paste

Why wrong: The thermal paste has already been replaced; adding more or reapplying is unlikely to resolve the issue.

Replace the power supply unit

Why wrong: The PSU fan is integrated, but the logs point to CPU temperature, not power supply failure. Replacing PSU would not address the root cause.

Swap the redundant power supplies to rule out a failing PSU.

Why wrong: While a failing PSU can cause shutdowns, it does not generate a thermal event log entry. The event log explicitly points to a thermal cause, making PSU replacement an ineffective initial response.

Replace the CPU heatsink and reapply thermal paste.

Why wrong: The CPU temperature is reported as normal (47°C), indicating that the heatsink is efficiently transferring heat away from the CPU. Replacing it is unnecessary and would not resolve a thermal event caused by another component.

Update the server firmware and BIOS to the latest version.

Why wrong: A firmware or BIOS bug could potentially cause false thermal shutdowns, but troubleshooting best practice dictates checking hardware sensors and physical conditions before applying updates. This is a later step if no physical cause is found.

Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

Why wrong: Windows Memory Diagnostic runs at boot and cannot dynamically restrict physical memory usage; the system would still attempt to use the faulty DIMM, risking another crash.

Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

Why wrong: The server has already experienced crashes, proving that uncorrectable errors have occurred. Relying solely on ECC is dangerous as it can lead to data corruption and additional unplanned downtime.

Immediately shut down the server, replace the faulty DIMM, and restart.

Why wrong: This action would abruptly halt the financial report processing, potentially causing data loss and missing the deadline, without following proper change control.

Connect each server's power supplies to two PDUs that are both on the same power feed, and use the second feed only as a cold standby in case of a primary feed failure.

Why wrong: This configuration protects against PDU failure but not against a failure of the active power feed. The cold standby requires manual intervention and cannot ensure continuous uptime during a primary feed outage.

Connect each server's power supplies to the same PDU, but distribute servers across the four PDUs for load balancing.

Why wrong: If a PDU fails, all servers connected to it will lose power. This design does not provide power redundancy at the server level, as each server relies on a single PDU.

Use a single large PDU with dual inputs from both feeds and an automatic transfer switch, connecting all servers to that PDU.

Why wrong: A single PDU represents a single point of failure; if the PDU itself fails, all servers lose power regardless of the redundant input feeds. This violates the requirement of no single point of failure.

Replace both processors as they are likely faulty

Why wrong: It is extremely rare for two CPUs to be simultaneously faulty out of the box; physical installation issues are far more common.

Clear the CMOS using the jumper or button on the motherboard

Why wrong: Clearing CMOS can resolve configuration mismatches but is not the most direct response to a 'CPU not detected' POST code.

Update the BIOS to the latest version using the IPMI interface

Why wrong: If the CPUs are on the supported list, a BIOS update is not needed. Moreover, a no-POST situation may prevent a firmware update even via IPMI.

Reboot all four web servers to clear any stuck processes.

Why wrong: A mass reboot is extreme and temporary; the malformed image could re-trigger the problem, and it does not address the load balancing flaw.

Increase RAM on web03 to handle the high CPU process better.

Why wrong: The issue is an infinite CPU loop, not a memory shortage. Adding RAM would not resolve the CPU spike or the underlying image processing bug.

Add two more servers to the farm and keep the round-robin algorithm.

Why wrong: Adding servers may reduce the likelihood of overloading, but it does not resolve the runaway process or the distribution issue; the faulty node still exists.

Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.

Why wrong: A full system restore would overwrite all data since the last backup, potentially losing recent files, and is a last resort.

Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.

Why wrong: Since POST passed and disks are detected, hardware reseating is unlikely to resolve the boot manager error.

Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.

Why wrong: Last Known Good Configuration only reverts registry and driver changes, not missing boot files, and may not even be accessible if the boot manager is missing.

Add two additional web servers to the farm to distribute the load.

Why wrong: Adding servers may temporarily reduce load per server, but the underlying port exhaustion will still occur on each under high traffic.

Schedule a nightly restart of the IIS application pools.

Why wrong: Nightly restarts would clear connections but cause downtime and do not prevent the port exhaustion during peak hours.

Reduce the maximum number of concurrent connections in the IIS application pool settings.

Why wrong: This might cap connections but could reject users and degrade performance without fixing the port shortage.

Restore the server from the firm's cloud backup service for email.

Why wrong: There is no cloud backup for the server; the scenario states the firm has no such service.

Scan the USB drive with antivirus, then restore the latest differential backup from it.

Why wrong: The USB drive was connected during the encryption and is likely compromised; antivirus may not fully clean it, and the backup itself may contain encrypted or infected files.

Pay the ransom to obtain the decryption key, then perform a full backup.

Why wrong: Paying the ransom does not guarantee file recovery, encourages criminal activity, and may not result in a fully clean system.

Execute 'rm -rf /tmp/*' to clear temporary files and regain space

Why wrong: This may disrupt running processes that rely on files in /tmp and is not a thorough solution; logs are more likely to consume space.

Use 'find / -type f -size +100M -exec rm {} \;' to delete all files larger than 100MB

Why wrong: This is extremely dangerous because it may delete important application or system files without discrimination.

Extend the root logical volume by 10 GB using 'lvextend' and then resize the filesystem with 'resize2fs'

Why wrong: While feasible, this is a reactive measure that doesn't address the accumulation of unnecessary files and might encourage poor storage hygiene; cleaning up first is best practice.

Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.

Why wrong: Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.

Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.

Why wrong: Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.

Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.

Why wrong: This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.