Performance-Based Questions (PBQs)

Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

Why wrong: Robocopy copying 2 TB over the network will likely exceed the four-hour window and cause user disruption.

Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

Why wrong: Full backup/restore of 2 TB over the network or locally will likely take longer than four hours, and may not preserve open file states.

Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

Why wrong: Tuning settings cannot make initial replication of 2 TB complete in four hours; the data volume is too large.

Use the RAID controller utility to set the new drive as a hot spare and then reboot

Why wrong: The new drive is not yet installed; setting as hot spare won't help if the missing drive is not detected.

Replace the missing drive with the new one and allow the RAID controller to automatically rebuild

Why wrong: This might be premature; the issue could be a loose connection, not a failed drive.

Rebuild the entire RAID array after backing up data from the surviving drives

Why wrong: This is excessive and risks data loss; a single drive issue can usually be resolved with less drastic measures.

The ambient temperature sensor in the data center is reporting incorrectly and the actual temperature is higher.

Why wrong: Handheld thermometer confirms 20°C; other servers in same rack are fine, so ambient is normal.

The internal fans are not operating at full speed due to a failed fan controller.

Why wrong: Fans are verified spinning, and a fan controller failure would likely cause constant overheating or sensor errors, not just peak hours.

The file server's power supply is failing and causing voltage drops that affect fan performance.

Why wrong: A failing PSU typically causes power-related errors or system instability, not specific CPU thermal events; fans are verified operational.

Update the server's BIOS to the latest version

Why wrong: BIOS updates rarely address random reboots unless a known bug exists, and this should not be the first step.

Replace the power supply unit

Why wrong: A failing PSU might cause reboots, but the UPS report suggests stable power; other symptoms like log errors would appear.

Disable the automatic restart feature in System Properties

Why wrong: This would only prevent the server from rebooting after a crash, but the underlying issue would remain, leading to possible data corruption.

Restart the Windows Server 2022 server to apply any pending policy changes.

Why wrong: Restarting does not assign the missing 'Log on as a service' right; the right must be explicitly granted before the service can start.

Configure the application to use a dynamic port instead of the static port 8443.

Why wrong: The application is designed to use a static port; changing to a dynamic port would likely break client connectivity and is not a proper fix for the logon failure.

Reset the service account password and update the service configuration.

Why wrong: The password was already verified correct, so resetting it is unnecessary and would not fix the missing 'Log on as a service' right.

Pay the ransom to decrypt the differential backup

Why wrong: Paying the ransom is not a recommended security practice and may not result in decryption.

Reinstall the operating system and restore files from cloud storage

Why wrong: There is no indication that cloud storage is available, and this would not utilize existing backups.

Restore using only Wednesday's differential backup

Why wrong: Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.

Implement a RAID 5 array instead of RAID 1 for better redundancy.

Why wrong: RAID 5 provides fault tolerance but does not protect against backup corruption or accidental data loss. The problem is the backup was not verified, not the RAID level.

Document the backup procedure and create a disaster recovery plan.

Why wrong: Documentation is important but does not ensure backups are restorable. Without testing, the corruption would remain undetected.

Use a cloud-based backup service with offsite storage.

Why wrong: Offsite backup is beneficial but does not directly address the need to verify backup integrity. Regular testing is still required even with cloud backups.

Configure RAID 10 on all database servers to improve disk performance.

Why wrong: RAID 10 improves disk I/O and fault tolerance but does not address the need for more frequent backups or point-in-time recovery.

Upgrade the WAN connection between sites to reduce backup transfer times.

Why wrong: A faster connection would not change the daily backup schedule. The RPO requires more frequent backups, not just faster ones.

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Why wrong: Changing the RTO does not resolve the RPO issue. The problem is data loss exceeding the allowed RPO, not the speed of recovery.

Encrypt all backup data at rest and in transit.

Why wrong: Encryption protects confidentiality but does not prevent destruction or modification of the backup data. Ransomware can encrypt already-encrypted files, making them unrecoverable.

Require multi-factor authentication for the backup service account.

Why wrong: MFA adds security but if the ransomware gains access through the account (e.g., via a compromised client), it can still encrypt backups. Immutable storage is needed.

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Why wrong: Air-gapping helps but is not foolproof; if the backup server is compromised during the window, ransomware can still spread. Immutability is a stronger safeguard.

The new replacement drive is faulty.

Why wrong: If the new drive were faulty, the rebuild would likely have failed or shown errors.

The motherboard has a faulty PCIe slot for the RAID controller.

Why wrong: Faulty PCIe slot would cause the controller to disappear or cause I/O errors, not parity errors.

The RAID controller cache module has failed.

Why wrong: Cache failure would cause write errors or performance issues, not parity errors on a mirrored pair.

Move the server to a cooler location in the data center

Why wrong: The ambient temperature is within acceptable range, so moving the server would not significantly improve cooling.

Reinstall the CPU heat sink with more thermal paste

Why wrong: The thermal paste has already been replaced; adding more or reapplying is unlikely to resolve the issue.

Replace the power supply unit

Why wrong: The PSU fan is integrated, but the logs point to CPU temperature, not power supply failure. Replacing PSU would not address the root cause.

Replace both processors as they are likely faulty

Why wrong: It is extremely rare for two CPUs to be simultaneously faulty out of the box; physical installation issues are far more common.

Clear the CMOS using the jumper or button on the motherboard

Why wrong: Clearing CMOS can resolve configuration mismatches but is not the most direct response to a 'CPU not detected' POST code.

Update the BIOS to the latest version using the IPMI interface

Why wrong: If the CPUs are on the supported list, a BIOS update is not needed. Moreover, a no-POST situation may prevent a firmware update even via IPMI.

Reseat all memory modules and clean the DIMM slots

Why wrong: Reseating is a basic troubleshooting step, but multiple passes of MemTest86+ with no errors suggest the electrical connections are sound.

Replace the hard drives with solid-state drives (SSDs)

Why wrong: SSDs would improve I/O performance and reduce power draw slightly, but they would not correct the underlying power instability that is causing ECC memory errors.

Replace the motherboard, as the memory controller is likely failing

Why wrong: No evidence points to a motherboard memory controller failure; MemTest86+ passes, and corrected errors can be caused by power fluctuations.

Configure RAID 10 by mirroring two pairs and striping across them, providing 2TB of storage with high performance and redundancy.

Why wrong: RAID 10 offers excellent performance and redundancy but consumes half the total capacity for mirroring (2TB usable). It does not maximize storage capacity as required.

Configure RAID 0 to stripe across all four drives for maximum 4TB storage and performance.

Why wrong: RAID 0 offers no data redundancy; a single drive failure results in total data loss, which fails the requirement for protection against drive failure.

Configure RAID 1 with two mirrored pairs, providing 2TB of total storage across two volumes, ensuring redundancy.

Why wrong: While this provides redundancy, it yields only 2TB of usable storage, which is less than RAID 5 and does not maximize capacity.

Swap the redundant power supplies to rule out a failing PSU.

Why wrong: While a failing PSU can cause shutdowns, it does not generate a thermal event log entry. The event log explicitly points to a thermal cause, making PSU replacement an ineffective initial response.

Replace the CPU heatsink and reapply thermal paste.

Why wrong: The CPU temperature is reported as normal (47°C), indicating that the heatsink is efficiently transferring heat away from the CPU. Replacing it is unnecessary and would not resolve a thermal event caused by another component.

Update the server firmware and BIOS to the latest version.

Why wrong: A firmware or BIOS bug could potentially cause false thermal shutdowns, but troubleshooting best practice dictates checking hardware sensors and physical conditions before applying updates. This is a later step if no physical cause is found.

Connect each server's power supplies to two PDUs that are both on the same power feed, and use the second feed only as a cold standby in case of a primary feed failure.

Why wrong: This configuration protects against PDU failure but not against a failure of the active power feed. The cold standby requires manual intervention and cannot ensure continuous uptime during a primary feed outage.

Connect each server's power supplies to the same PDU, but distribute servers across the four PDUs for load balancing.

Why wrong: If a PDU fails, all servers connected to it will lose power. This design does not provide power redundancy at the server level, as each server relies on a single PDU.

Use a single large PDU with dual inputs from both feeds and an automatic transfer switch, connecting all servers to that PDU.

Why wrong: A single PDU represents a single point of failure; if the PDU itself fails, all servers lose power regardless of the redundant input feeds. This violates the requirement of no single point of failure.

Replace the SATA hard drives with SSDs and configure RAID 10 for better I/O performance.

Why wrong: Faster storage is important for I/O-intensive VMs like databases, but without sufficient RAM, the VMs may not even start or will constantly swap, negating any storage speed gains.

Add a second 1 GbE network interface and configure NIC teaming for redundancy.

Why wrong: Network redundancy is important for uptime but does not address the primary issue of insufficient memory. The server will not function properly underload with only 16 GB of RAM.

Upgrade the CPU to a model with at least 8 cores and 16 threads.

Why wrong: While more cores are beneficial, 4 cores/8 threads can often handle moderate VM loads. The more pressing issue is the severe lack of RAM, which will cause immediate performance failure.

Order a replacement system board and express ship it to the branch for a technician to install later.

Why wrong: This would extend downtime beyond the 48-hour technician travel time, plus the shipping time for the part. It is not the most expedient solution.

Instruct a non-technical employee at the branch to reseat the power supply and clear the error log.

Why wrong: A voltage regulator failure on the system board is unlikely to be resolved by reseating the power supply. This could lead to further confusion or safety issues for untrained personnel.

Dispatch a technician with a replacement voltage regulator module for on-site repair.

Why wrong: Voltage regulator modules are not typically designed for field replacement; they are part of the motherboard. This approach would likely fail and cause further delays.

Wait for the disk to completely fail so that the hot spare will automatically rebuild the array

Why wrong: This is risky because if another disk fails before the rebuild completes, the entire array could be lost.

Take a full backup immediately and then replace the disk during the next maintenance window

Why wrong: A backup protects data but does not restore redundancy; the array could still fail in the meantime.

Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later

Why wrong: Removing the disk intentionally degrades the array and may cause performance impact; using the hot spare directly is cleaner.

Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.

Why wrong: Windows Memory Diagnostic runs at boot and cannot dynamically restrict physical memory usage; the system would still attempt to use the faulty DIMM, risking another crash.

Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.

Why wrong: The server has already experienced crashes, proving that uncorrectable errors have occurred. Relying solely on ECC is dangerous as it can lead to data corruption and additional unplanned downtime.

Immediately shut down the server, replace the faulty DIMM, and restart.

Why wrong: This action would abruptly halt the financial report processing, potentially causing data loss and missing the deadline, without following proper change control.