Scenario practice questions

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Trap 1: Last full backup and all differential backups since Sunday

Differential backups are cumulative, so only the most recent one is needed; applying all would be redundant but not harmful, though unnecessary.

Trap 2: Last full backup only

A full backup alone would restore data only up to Sunday, losing all changes made on Monday, Tuesday, and Wednesday.

Trap 3: Last full backup and all incremental backups since Sunday

This would be correct for an incremental strategy, but the scenario uses differential backups, not incremental.

A
Last full backup and all differential backups since Sunday
Why wrong: Differential backups are cumulative, so only the most recent one is needed; applying all would be redundant but not harmful, though unnecessary.
B
Last full backup only
Why wrong: A full backup alone would restore data only up to Sunday, losing all changes made on Monday, Tuesday, and Wednesday.
C
Last full backup and the latest differential backup
This restores the database to the state at the time of the last differential, which includes all changes since Sunday.
D
Last full backup and all incremental backups since Sunday
Why wrong: This would be correct for an incremental strategy, but the scenario uses differential backups, not incremental.

Question 2easymultiple choice

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Trap 1: Parallel test

A parallel test requires resources and coordination to run systems at a secondary site, resulting in moderate cost and some operational overhead.

Trap 2: Full interruption test

A full interruption test causes actual downtime and disrupts business operations, violating the requirement for minimal disruption.

Trap 3: Simulation test

A simulation test often involves realistic drills or limited system activation, which can be more expensive and disruptive than a tabletop exercise.

A
Tabletop exercise
A tabletop exercise is a walk-through discussion that incurs almost no direct cost and zero disruption, making it ideal for initial plan verification.
B
Parallel test
Why wrong: A parallel test requires resources and coordination to run systems at a secondary site, resulting in moderate cost and some operational overhead.
C
Full interruption test
Why wrong: A full interruption test causes actual downtime and disrupts business operations, violating the requirement for minimal disruption.
D
Simulation test
Why wrong: A simulation test often involves realistic drills or limited system activation, which can be more expensive and disruptive than a tabletop exercise.

Question 3hardScenario

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Trap 1: Pay the ransom to obtain the decryption key, then restore the…

Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.

Trap 2: Rebuild the servers from scratch using clean media, and manually…

Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.

Trap 3: Wait for the backup operator to return the tape, then restore from…

This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.

A
Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.
Why wrong: Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.
B
Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.
Why wrong: Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.
C
Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.
Why wrong: This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.
D
Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).
This approach maximizes data recovery by using the safest restoration method, leveraging existing backups, and attempting to salvage recent data from logs that may not have been encrypted.

Study the full virtualization explanation →

Question 4hardmultiple choice

A virtualization administrator notices that a critical VM on an ESXi host has high CPU Ready time (%RDY) according to performance charts. The VM has 8 vCPUs assigned, and the host has two physical CPUs with 8 cores each. Other VMs on the host are performing normally. Which of the following actions would MOST likely resolve the high CPU Ready time for this VM?

Trap 1: Increase the number of physical cores in the host by adding another…

Adding physical cores is a hardware change that may not be immediately feasible and does not address the root cause; the host may have sufficient capacity if the VM's vCPU count is appropriate.

Trap 2: Enable CPU affinity to pin the VM to specific physical cores.

CPU pinning can reduce overhead but may not resolve contention if the host is oversubscribed; it can also lead to other issues.

Trap 3: Reduce the number of vCPUs assigned to the VM to 4.

Reducing vCPUs might help if the VM is not using all vCPUs efficiently, but it could hurt performance if the workload needs 8 vCPUs; migration is a less intrusive first step.

A
Increase the number of physical cores in the host by adding another CPU.
Why wrong: Adding physical cores is a hardware change that may not be immediately feasible and does not address the root cause; the host may have sufficient capacity if the VM's vCPU count is appropriate.
B
Enable CPU affinity to pin the VM to specific physical cores.
Why wrong: CPU pinning can reduce overhead but may not resolve contention if the host is oversubscribed; it can also lead to other issues.
C
Reduce the number of vCPUs assigned to the VM to 4.
Why wrong: Reducing vCPUs might help if the VM is not using all vCPUs efficiently, but it could hurt performance if the workload needs 8 vCPUs; migration is a less intrusive first step.
D
Migrate the VM to another host with more available CPU capacity.
High CPU Ready time indicates the VM is waiting for physical CPU resources. Migrating to a less contended host resolves the issue without changing the VM's configuration.

Question 5easymultiple choice

A server in the datacenter fails to power on after a scheduled power maintenance. The facility team confirms that power is being supplied to the rack. The server's front panel LED is not illuminated. Which of the following should the administrator check FIRST?

Trap 1: Reseat the CPU and memory modules.

Reseating internal components is irrelevant when there is no power indication; power issues should be ruled out first.

Trap 2: Replace the power supply unit.

Prematurely replacing the PSU without first checking basic connections is inefficient and may not resolve the issue if the problem is a loose cable.

Trap 3: Update the server's BIOS firmware.

BIOS firmware updates do not prevent a server from receiving power and are not a typical step for a no-power condition.

A
Reseat the CPU and memory modules.
Why wrong: Reseating internal components is irrelevant when there is no power indication; power issues should be ruled out first.
B
Verify that the power cable is securely connected to the server and the PDU.
Checking physical power connections is the most logical first step in a no-power situation, as cables can become loose during maintenance activities.
C
Replace the power supply unit.
Why wrong: Prematurely replacing the PSU without first checking basic connections is inefficient and may not resolve the issue if the problem is a loose cable.
D
Update the server's BIOS firmware.
Why wrong: BIOS firmware updates do not prevent a server from receiving power and are not a typical step for a no-power condition.