Knowledge + Practice

← Back to CompTIA Server+ SK0-005 questions

Scenario-based practice

Performance-Based Questions (PBQs)

Practise CompTIA Server+ SK0-005 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

20

scenario questions

SK0-005

exam code

CompTIA

vendor

Scenario guide

How to approach performance-based questions (pbqs)

Performance-based questions drop you into a simulated CLI or lab environment and ask you to complete a real configuration task. On Cisco exams this means IOS commands in a terminal with a live topology. PBQs are worth more marks and appear first in the exam — get these right.

Quick answer

Performance-Based Questions (PBQs) questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related SK0-005 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

server-administration practice questions

Sharpen your SK0-005 knowledge of server-administration.

server-hardware-installation-management practice questions

Sharpen your SK0-005 knowledge of server-hardware-installation-management.

security-disaster-recovery practice questions

Targeted SK0-005 practice covering security-disaster-recovery.

troubleshooting practice questions

Work through SK0-005 questions on troubleshooting.

SK0-005 fundamentals practice questions

Work through SK0-005 questions on SK0-005 fundamentals.

SK0-005 scenario practice questions

Work through SK0-005 questions on SK0-005 scenario.

Practice set

Practice scenarios

Question 1mediumScenario

Full question →

A server administrator is assembling a new high-performance server using a Supermicro X12 motherboard, two Intel Xeon Gold 5317 processors (LGA 4189 socket), and 16x 32GB DDR4-3200 ECC LRDIMMs for a total of 512GB of memory. The chassis has redundant 1600W power supplies. After assembling all components, the administrator powers on the server. All fans start spinning at full speed, and the front panel LEDs illuminate. However, the server does not POST, there are no beep codes, and no video output is displayed. The motherboard has a two-digit hexadecimal POST code LED display, which shows '00' and does not change. The motherboard manual states that code '00' indicates the CPU is not detected or has failed. The processors are confirmed to be the correct socket type and stepping as required by the motherboard. What should the technician do FIRST?

A
Reseat both processors and inspect the CPU sockets for bent pins
LGA sockets have delicate pins that can bend, causing CPU detection failures. Reseating and inspection are the logical first steps.
B
Replace both processors as they are likely faulty
Why it fails: It is extremely rare for two CPUs to be simultaneously faulty out of the box; physical installation issues are far more common.
C
Clear the CMOS using the jumper or button on the motherboard
Why it fails: Clearing CMOS can resolve configuration mismatches but is not the most direct response to a 'CPU not detected' POST code.
D
Update the BIOS to the latest version using the IPMI interface
Why it fails: If the CPUs are on the supported list, a BIOS update is not needed. Moreover, a no-POST situation may prevent a firmware update even via IPMI.

Full breakdown with real-world context →

Question 2easyScenario

Full question →

A small business has purchased a new server to function as a file server for 25 employees. The server is equipped with four 1TB SATA hard disk drives and no hardware RAID controller; the operating system supports software RAID. The business owner's primary requirements are data redundancy to protect against a single drive failure and maximum usable storage capacity, while keeping costs low. The IT technician is tasked with configuring the storage. The technician evaluates the following options: RAID 0 striping across all four drives; RAID 1 mirroring using two pairs (drives 1+2 mirrored, drives 3+4 mirrored), providing two separate volumes; RAID 5 with parity across all four drives; and RAID 10 combining mirroring and striping. The technician needs to recommend the configuration that best meets the requirements. Which of the following should the technician implement?

A
Configure RAID 10 by mirroring two pairs and striping across them, providing 2TB of storage with high performance and redundancy.
Why it fails: RAID 10 offers excellent performance and redundancy but consumes half the total capacity for mirroring (2TB usable). It does not maximize storage capacity as required.
B
Configure RAID 5 to stripe data and parity across all four drives, providing 3TB of usable storage with single-drive fault tolerance.
RAID 5 uses one drive's worth of capacity for parity, resulting in 3TB usable. It tolerates a single drive failure and meets both redundancy and maximum capacity requirements within a software RAID setup.
C
Configure RAID 0 to stripe across all four drives for maximum 4TB storage and performance.
Why it fails: RAID 0 offers no data redundancy; a single drive failure results in total data loss, which fails the requirement for protection against drive failure.
D
Configure RAID 1 with two mirrored pairs, providing 2TB of total storage across two volumes, ensuring redundancy.
Why it fails: While this provides redundancy, it yields only 2TB of usable storage, which is less than RAID 5 and does not maximize capacity.

Full breakdown with real-world context →

Question 3hardScenario

Open the full VLAN trunking answer →

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

A
Reboot HostB to renegotiate the network configuration.
Why it fails: Rebooting is a disruptive last resort; the issue is likely a static VLAN misconfig that a reboot won't fix unless the host's switch configuration is corrected.
B
Restart the vCenter Server service on the vCenter appliance.
Why it fails: vCenter manages the cluster but host networking is configured on each host; restarting vCenter does not change switch or host VLAN settings.
C
vMotion all affected VMs from HostB to HostA to confirm they work on HostA.
Why it fails: This would confirm the VMs are functional, but it does not fix HostB's networking and may not be possible if HostB's VM network is down.
D
Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.
The symptoms point to a VLAN misconfiguration on the new switch affecting only VM traffic; verifying and correcting the VLANs will likely resolve the disconnection.

Full breakdown with real-world context →

Question 4easyScenario

Full question →

A technician receives an urgent alert that a critical file server at a remote branch office has gone offline and is unreachable over the network. The server is accessible via out-of-band IPMI, which indicates that chassis power is present, but the power LED on the server is blinking amber instead of steady green. The IPMI system event log reports "System board voltage regulator failure" as the last critical event before the failure. Attempts to use the remote KVM show no video output, and Wake-on-LAN commands have no effect. The branch office has no on-site IT personnel; the only staff are general office workers with minimal technical training. The earliest a field technician can travel to the site is 48 hours. The main office has an identically configured spare server and a backup image of the file server's system disk. The branch office staff can follow simple plug-and-play instructions if provided. Which of the following is the BEST immediate course of action to restore the file services with minimal downtime?

A
Order a replacement system board and express ship it to the branch for a technician to install later.
Why it fails: This would extend downtime beyond the 48-hour technician travel time, plus the shipping time for the part. It is not the most expedient solution.
B
Ship the spare server and a pre-configured backup image to the branch office for local staff to swap.
This allows non-technical staff to perform a hardware swap by following simple instructions, restoring service in hours instead of days. It bypasses the need for an on-site technician.
C
Instruct a non-technical employee at the branch to reseat the power supply and clear the error log.
Why it fails: A voltage regulator failure on the system board is unlikely to be resolved by reseating the power supply. This could lead to further confusion or safety issues for untrained personnel.
D
Dispatch a technician with a replacement voltage regulator module for on-site repair.
Why it fails: Voltage regulator modules are not typically designed for field replacement; they are part of the motherboard. This approach would likely fail and cause further delays.

Full breakdown with real-world context →

Question 5hardScenario

Full question →

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

A
Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.
Why it fails: Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.
B
Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.
Why it fails: Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.
C
Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.
Why it fails: This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.
D
Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).
This approach maximizes data recovery by using the safest restoration method, leveraging existing backups, and attempting to salvage recent data from logs that may not have been encrypted.

Full breakdown with real-world context →

Question 6hardScenario

Full question →

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

A
Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.
This comprehensive approach resolves the immediate CPU issue, prevents future misdirection of traffic, and removes the root cause.
B
Reboot all four web servers to clear any stuck processes.
Why it fails: A mass reboot is extreme and temporary; the malformed image could re-trigger the problem, and it does not address the load balancing flaw.
C
Increase RAM on web03 to handle the high CPU process better.
Why it fails: The issue is an infinite CPU loop, not a memory shortage. Adding RAM would not resolve the CPU spike or the underlying image processing bug.
D
Add two more servers to the farm and keep the round-robin algorithm.
Why it fails: Adding servers may reduce the likelihood of overloading, but it does not resolve the runaway process or the distribution issue; the faulty node still exists.

Full breakdown with real-world context →

Question 7mediumScenario

Open the full VLAN trunking answer →

A medium-size enterprise runs a vSphere 7.0 cluster with two hosts (HostA and HostB) for production VMs. Each host has two 10GbE uplinks (vmnic0 and vmnic1) connected to separate physical switches (SW1 and SW2) for redundancy. A single vSphere standard switch (vSwitch0) uses both uplinks with teaming policy set to 'Route based on originating virtual port ID,' 'Network failure detection: Link status only,' and 'Notify switches: Yes.' Lately, several VMs running on HostA experience intermittent network disconnections lasting 20–30 seconds, while VMs on HostB are unaffected. The administrator checks vCenter events and sees repeated messages: 'Lost uplink redundancy on vSwitch0. vmnic0 is down.' followed seconds later by 'Uplink redundancy restored. vmnic0 is up.' The physical switch SW1's log shows the port for vmnic0 transitions through spanning-tree listening and learning states each time this occurs, taking about 15 seconds. The link is a trunk allowing all necessary VLANs, with no errors or security violations. The network team has already swapped the fiber cable and SFP+ transceiver for vmnic0 without improvement. The VMs affected are those whose virtual ports are pinned to vmnic0 by the load-balancing policy; VMs pinned to vmnic1 never experience disconnections. The administrator has also rebooted HostA and updated the NIC firmware, but the flapping continues. What should the administrator do to permanently resolve the intermittent connectivity?

A
Disable the 'Notify switches' option on the vSwitch teaming configuration to avoid unnecessary RARP broadcasts.
Why it fails: Notify switches helps update physical switch MAC tables during failover; disabling it could lead to longer outages or black-holing. It is not the source of the STP delays.
B
Reconfigure the physical switch port for vmnic0 to an access port instead of a trunk to simplify spanning-tree operations.
Why it fails: Changing to access mode would break multiple VLANs required for VMs, and would not prevent the spanning-tree convergence delays.
C
Enable spanning-tree PortFast on the SW1 and SW2 ports connected to the hosts so the ports bypass the listening/learning states.
The physical switch ports are transitioning through STP states when the link flaps, causing a prolonged outage. Enabling PortFast (or edge port) forces the port directly into forwarding state, eliminating the 15-second delay.
D
Change the NIC teaming load balancing policy to 'Route based on IP hash' to distribute traffic across both uplinks more evenly.
Why it fails: While IP hash can improve load distribution, it does not prevent STP convergence delays caused by link flapping and would not fix the root cause of the flapping or the resulting disconnections.

Full breakdown with real-world context →

Question 8mediumScenario

Full question →

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A
Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.
Why it fails: Log shipping only protects databases, not file servers or other applications, and manual failover would exceed the 2-hour RTO.
B
Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.
Why it fails: A 4-hour backup frequency fails the 15-minute RPO, and manual processes would not reduce the RTO from 4 hours.
C
Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.
Why it fails: Upgrading bandwidth and synchronous replication are expensive and beyond the stated budget constraints, though they would technically meet RPO/RTO.
D
Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.
Asynchronous replication at 15-minute intervals meets the RPO, and automation reduces the failover time to within 2 hours, all without major bandwidth upgrades.

Full breakdown with real-world context →

Question 9hardScenario

Full question →

A large financial services company must comply with federal regulations mandating quarterly disaster recovery tests. Their primary data center in New York hosts all trading applications, and a hot site in Chicago is maintained with real-time data replication via synchronous mirroring. During the last DR test, the IT team successfully failed over network and storage within 8 minutes, meeting the 15-minute RTO for connectivity. However, they encountered a major issue: the hot site's firewalls, intrusion detection systems, and application-level access controls were not configured to match the primary environment. The security team had to manually create firewall rules, update IDS signatures, and reconfigure access policies based on documentation, which took over 4 hours. As a result, the total system readiness exceeded 4.5 hours, causing a significant gap in trading operations. The regulatory auditor noted this deficiency and required a corrective action plan. The company must ensure that the next DR test achieves full operational readiness, including security controls, within the 15-minute RTO. The IT budget is already allocated for the current fiscal year, so large capital expenditures are not possible, but the team can leverage existing tools and automation. Which of the following is the BEST approach to address this issue?

A
Develop detailed runbooks for the security team to manually configure devices during failover; then conduct quarterly drills to reduce configuration time.
Why it fails: Even with practice, manually configuring complex security devices within 15 minutes is unrealistic due to the volume of rules and potential for error; human speed cannot match automation.
B
Re-evaluate the RTO to extend it to 4 hours and inform regulators of a realistic capability.
Why it fails: Changing the RTO does not solve the technical deficiency; it merely accepts failure and would likely not satisfy regulatory mandates that require a 15-minute recovery capability.
C
Replace the existing firewalls and IDS at the hot site with identical hardware from the same vendors as the primary site.
Why it fails: Identical hardware alone does not ensure configurations match; the security rules and policies still need to be manually or automatically applied, so this does not reduce the configuration time.
D
Implement a configuration management tool that automatically synchronizes firewall rules, IDS signatures, and access controls to the hot site in near real-time.
Automation ensures the hot site security posture mirrors the primary continuously, eliminating the manual delay and making it possible to meet the 15-minute RTO during failover.

Full breakdown with real-world context →

Question 10hardScenario

Full question →

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

A
Add two additional web servers to the farm to distribute the load.
Why it fails: Adding servers may temporarily reduce load per server, but the underlying port exhaustion will still occur on each under high traffic.
B
Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.
This directly addresses the port exhaustion by expanding the available port pool and speeding up port recycling.
C
Schedule a nightly restart of the IIS application pools.
Why it fails: Nightly restarts would clear connections but cause downtime and do not prevent the port exhaustion during peak hours.
D
Reduce the maximum number of concurrent connections in the IIS application pool settings.
Why it fails: This might cap connections but could reject users and degrade performance without fixing the port shortage.

Full breakdown with real-world context →

Question 11easyScenario

Full question →

A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?

A
Replace the power supply with a compatible, known-good unit.
Fans spinning briefly then stopping, no POST, and no beep codes strongly suggest that the power supply is unable to sustain the required voltages, likely due to surge damage. Replacing the PSU is the most efficient step.
B
Swap the motherboard with an identical one from a spare parts inventory.
Why it fails: Replacing the motherboard is invasive, time-consuming, and may not be necessary; the symptoms are more characteristic of a power supply failure.
C
Connect the server directly to a different power outlet, bypassing the surge protector.
Why it fails: The outlet and surge protector have already been validated with other devices; moving the server to another outlet is redundant and would not fix a faulty power supply.
D
Remove the server's RAM modules and reinstall them one at a time, testing after each.
Why it fails: While reseating RAM can resolve no-POST scenarios, the sudden failure after a power surge and the complete lack of beep codes makes a power-supply issue far more likely and should be tested first.

Full breakdown with real-world context →

Question 12easyScenario

Full question →

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A
Restore the server from the firm's cloud backup service for email.
Why it fails: There is no cloud backup for the server; the scenario states the firm has no such service.
B
Scan the USB drive with antivirus, then restore the latest differential backup from it.
Why it fails: The USB drive was connected during the encryption and is likely compromised; antivirus may not fully clean it, and the backup itself may contain encrypted or infected files.
C
Pay the ransom to obtain the decryption key, then perform a full backup.
Why it fails: Paying the ransom does not guarantee file recovery, encourages criminal activity, and may not result in a fully clean system.
D
Reimage the server, then restore data from the Friday offsite tape backup.
Offsite tape is clean and the reimage ensures no malware persists, providing a fresh, reliable start.

Full breakdown with real-world context →

Question 13mediumScenario

Full question →

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

A
Configure RAID 10 on all database servers to improve disk performance.
Why it fails: RAID 10 improves disk I/O and fault tolerance but does not address the need for more frequent backups or point-in-time recovery.
B
Upgrade the WAN connection between sites to reduce backup transfer times.
Why it fails: A faster connection would not change the daily backup schedule. The RPO requires more frequent backups, not just faster ones.
C
Enable log shipping with point-in-time recovery for the database.
Log shipping allows transaction log backups to be taken frequently (e.g., every 15 minutes) and applied to the standby database, enabling recovery to any point in time, thus meeting the 1-hour RPO.
D
Adjust the RTO to 8 hours to allow for more comprehensive backups.
Why it fails: Changing the RTO does not resolve the RPO issue. The problem is data loss exceeding the allowed RPO, not the speed of recovery.

Full breakdown with real-world context →

Question 14mediumScenario

Full question →

A medium-sized business runs a critical internal application on a single physical server running Windows Server 2019. The application is memory-intensive, often using up to 24 GB out of 32 GB RAM during peak hours. Over the past week, the server has experienced three unexpected reboots, each occurring during peak load. The server is not part of a cluster, and all data is stored on local disks. You have checked the Windows System event log and found Event ID 41 (Kernel-Power) indicating an unexpected shutdown. There are no related critical errors in the Application log. You have also reviewed the server's firmware logs and found multiple corrected memory errors (ECC) over the last month, with an increase in frequency just before each crash. The server is under warranty, and the hardware vendor's diagnostic tools report a failing memory module in DIMM slot A1. The vendor has recommended replacing the faulty DIMM immediately. However, the server is currently processing critical end-of-quarter financial reports that cannot be interrupted for at least 6 hours. Which of the following is the BEST course of action to minimize risk of data loss and downtime until a planned maintenance window?

A
Use Windows Memory Diagnostic tool to try to isolate the memory region and prevent the application from using it.
Why it fails: Windows Memory Diagnostic tests memory offline, after a reboot into the test environment, and reports results; it cannot fence off bad memory while Windows keeps running, so the application would continue to use the failing module. Running it would also require the downtime the business cannot accept right now. The vendor's diagnostics have already identified DIMM A1 as the faulty part.
B
Continue running the server as is, as ECC memory can correct errors and the server will only crash if errors are uncorrectable; the risk is low.
Why it fails: ECC corrects single-bit errors, but a rising rate of corrected errors is a warning that uncorrectable ones are coming, and three crashes this week show that has already happened. Uncorrectable errors crash the server immediately and can corrupt data being written. Treating the risk as low ignores the evidence; it needs escalation, protection of data, and a planned replacement.
C
Immediately shut down the server, replace the faulty DIMM, and restart.
Why it fails: Replacing the DIMM fixes the root cause, but shutting down without approval would interrupt critical end-of-quarter reports, possibly losing work in progress and missing deadlines, and it bypasses change management. The decision to interrupt belongs to the business once it understands the risk. The right move is to escalate for an emergency change and protect data while waiting.
D
Inform management of the criticality, request emergency approval for immediate maintenance, and if denied, ensure current backups are verified and monitor the server closely for any signs of degradation until the maintenance window.
This balances technical risk with business needs: management hears the risk in business terms and can approve an emergency replacement now. If they decide to continue, the team verifies recent backups, saves or exports in-progress work where possible, watches the management controller and event logs closely, and has the replacement DIMM on site to swap as soon as the reports finish.

Full breakdown with real-world context →

Question 15mediumScenario

Full question →

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

A
Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.
Why it fails: The issue is CPU starvation, not memory pressure. More memory will not stop the Cartesian product from consuming CPU cycles.
B
Immediately add more vCPUs to the virtual machine to handle the increased load.
Why it fails: Adding vCPUs is a hardware resource change that requires VM downtime and licensing adjustments, and it does not fix the inefficient query that caused the spike.
C
Identify and kill the offending long-running query using the SQL Server management tools.
Terminating the problematic query releases the consumed CPU and brings performance back to normal quickly, with minimal impact on other users.
D
Restart the SQL Server service to clear all active connections and start fresh.
Why it fails: Restarting the service will cause a complete outage for all databases and users, which is disproportionate to the problem when a single query can be killed.

Full breakdown with real-world context →

Question 16hardScenario

Full question →

Your organization is migrating a Windows Server 2019 file server with 2 TB of shared data to a new server running Windows Server 2022. The migration must minimize user downtime and ensure file permissions are preserved. Users access files during business hours (8 AM to 6 PM) and the migration must be completed within a four-hour window starting at 10 PM on Saturday. You plan to use DFS Replication (DFSR) for initial data copy and then perform a final synchronization during the cutover. After setting up DFSR between the old and new servers, you realize that the initial replication will take approximately 12 hours due to the large number of files. What should you do to complete the migration within the allowed window?

A
Use robocopy to pre-stage the data from old to new server during off-hours before the cutover, then enable DFSR to replicate only changes made after pre-staging; during the cutover window, do a final DFSR sync
Pre-staging reduces the data transferred during the cutover to only changes, allowing the final sync to complete within the window.
B
Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data
Why it fails: Robocopy copying 2 TB over the network will likely exceed the four-hour window and cause user disruption.
C
Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup
Why it fails: Full backup/restore of 2 TB over the network or locally will likely take longer than four hours, and may not preserve open file states.
D
Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication
Why it fails: Tuning settings cannot make initial replication of 2 TB complete in four hours; the data volume is too large.

Full breakdown with real-world context →

Question 17hardScenario

Full question →

A company operates a Windows Server 2019 machine that functions as a domain controller and file server. Over the past week, the server has randomly rebooted several times, often during periods of heavy file access. The administrator reviews the System event log and finds multiple Event ID 41 (Kernel-Power) entries with no preceding critical errors. The server is connected to an uninterruptible power supply (UPS) that reports stable input voltage. The server room temperature sensors indicate normal ambient temperature (22°C / 72°F). The server hardware is three years old and has not had any recent changes. The administrator has already run a full antivirus scan with no threats found. Which of the following should the administrator do NEXT to diagnose the issue?

A
Inspect and clean the CPU and chassis fans, and check for dust buildup
Internal fans may be clogged or failing, causing thermal throttling and random shutdowns despite normal ambient temperature.
B
Update the server's BIOS to the latest version
Why it fails: BIOS updates rarely address random reboots unless a known bug exists, and this should not be the first step.
C
Replace the power supply unit
Why it fails: A failing PSU might cause reboots, but the UPS report suggests stable power; other symptoms like log errors would appear.
D
Disable the automatic restart feature in System Properties
Why it fails: This would only prevent the server from rebooting after a crash, but the underlying issue would remain, leading to possible data corruption.

Full breakdown with real-world context →

Question 18mediumScenario

Full question →

A server administrator receives reports that a production server is shutting down unexpectedly after running for several hours. The server is a 2U rackmount unit located in a data center with proper ambient cooling (20°C/68°F). The server has redundant power supplies connected to separate PDUs and no power anomalies are reported. The administrator checks the operating system event logs and finds a critical log entry: 'The system was shut down due to a thermal event.' However, the CPU temperature logs show that the CPU was at 47°C at the time of shutdown, and the chassis inlet temperature was 23°C. The server's internal fans are running at high speed and are clearly audible. The administrator suspects a thermal issue but is unsure why the CPU is not showing high temperature. The server has a baseboard management controller (BMC) that monitors various sensors. Which of the following components should the administrator investigate FIRST to identify the likely cause of the shutdown?

A
Swap the redundant power supplies to rule out a failing PSU.
Why it fails: While a failing PSU can cause shutdowns, it does not generate a thermal event log entry. The event log explicitly points to a thermal cause, making PSU replacement an ineffective initial response.
B
Inspect the voltage regulator module (VRM) temperatures and airflow around the motherboard.
VRMs are prone to overheating and can trigger system-level thermal shutdown protection. Checking their sensors and ensuring proper airflow over the motherboard is a logical first step in diagnosing a non-CPU thermal event.
C
Replace the CPU heatsink and reapply thermal paste.
Why it fails: The CPU temperature is reported as normal (47°C), indicating that the heatsink is efficiently transferring heat away from the CPU. Replacing it is unnecessary and would not resolve a thermal event caused by another component.
D
Update the server firmware and BIOS to the latest version.
Why it fails: A firmware or BIOS bug could potentially cause false thermal shutdowns, but troubleshooting best practice dictates checking hardware sensors and physical conditions before applying updates. This is a later step if no physical cause is found.

Full breakdown with real-world context →

Question 19hardScenario

Study the full virtualization explanation →

A company has a virtualized server environment with two physical hosts running VMware vSphere. Each host has 2 CPUs, 128GB RAM, and 6x 600GB SAS drives in RAID 10. Recently, host A experienced a power surge that caused it to shut down abruptly. After restarting, the host boots but the RAID controller reports that one of the drives in the RAID 10 array is missing. The administrator has a replacement drive of the same model. What should the administrator do first?

A
Use the RAID controller utility to set the new drive as a hot spare and then reboot
Why it fails: The new drive is not yet installed; setting as hot spare won't help if the missing drive is not detected.
B
Replace the missing drive with the new one and allow the RAID controller to automatically rebuild
Why it fails: This might be premature; the issue could be a loose connection, not a failed drive.
C
Check the RAID controller logs to determine if the drive is faulty or if it's a connection issue, and then reseat the drive or replace cables before replacing
Checking logs and reseating is the safest first step to confirm the drive is actually faulty.
D
Rebuild the entire RAID array after backing up data from the surviving drives
Why it fails: This is excessive and risks data loss; a single drive issue can usually be resolved with less drastic measures.

Full breakdown with real-world context →

Question 20hardScenario

Full question →

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A
Switch to daily full backups to a local NAS, which takes 8 hours.
Why it fails: A 24-hour RPO (if attack occurs before next full) does not meet the 4-hour requirement, and an 8-hour restore will likely exceed the RTO, especially for large data sets.
B
Adopt real-time replication to a hot site located offsite.
Why it fails: This is well outside the $200/month budget and adds complexity that the two-person IT team cannot manage.
C
Continue the current strategy but increase the frequency of differential backups to every 4 hours.
Why it fails: Differential backups grow over time; running them every 4 hours would greatly extend the backup window, and there is still a potential 4-hour data loss gap if an attack occurs just before a backup.
D
Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
This approach provides a practical balance of near-continuous data protection (RPO ≤ 1 hour), acceptable RTO, and fits the budget.

Full breakdown with real-world context →

These SK0-005 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style SK0-005 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.