Scenario practice questions

An organization wants to test its disaster recovery plan with minimal disruption to business operations and minimal cost. The test should verify the plan's effectiveness by discussing scenarios. Which type of test should they perform?

Trap 1: Parallel test

A parallel test requires resources and coordination to run systems at a secondary site, resulting in moderate cost and some operational overhead.

Trap 2: Full interruption test

A full interruption test causes actual downtime and disrupts business operations, violating the requirement for minimal disruption.

Trap 3: Simulation test

A simulation test often involves realistic drills or limited system activation, which can be more expensive and disruptive than a tabletop exercise.

A
Tabletop exercise
A tabletop exercise is a walk-through discussion that incurs almost no direct cost and zero disruption, making it ideal for initial plan verification.
B
Parallel test
Why it fails: A parallel test requires resources and coordination to run systems at a secondary site, resulting in moderate cost and some operational overhead.
C
Full interruption test
Why it fails: A full interruption test causes actual downtime and disrupts business operations, violating the requirement for minimal disruption.
D
Simulation test
Why it fails: A simulation test often involves realistic drills or limited system activation, which can be more expensive and disruptive than a tabletop exercise.

Question 2hardmulti select

A security administrator is hardening a Linux server that hosts a public web application. The server currently allows root login via SSH and uses default SSH port 22. The administrator wants to reduce the attack surface by implementing SSH best practices. Which two actions should the administrator take? (Choose two.)

Trap 1: Change the SSH port from 22 to a non-standard port, such as 2222.

Changing the SSH port is a form of security through obscurity. It may reduce automated scanning noise but does not provide real security benefits, as attackers can easily scan for open ports. It can also complicate firewall rules and legitimate access. While sometimes used, it is not considered a best practice for reducing attack surface compared to disabling root login and using key-based authentication. Therefore, it is not one of the two best actions.

Trap 2: Enable password authentication to ensure only authorized users can…

Enabling password authentication is the opposite of hardening; passwords can be brute-forced or guessed. Best practice is to disable password authentication and use SSH key-based authentication, which is more secure. The scenario implies the server is public, so password authentication increases risk. This action would not reduce attack surface and is therefore incorrect.

Trap 3: Allow SSH access from any IP address to ensure administrators can…

Allowing SSH from any IP address increases the attack surface by exposing the service to the entire internet. Best practice is to restrict SSH access to specific management subnets or IP addresses using firewall rules or TCP wrappers. This limits the number of potential attackers. The scenario's goal is to reduce attack surface, so this action is counterproductive and incorrect.

A
Change the SSH port from 22 to a non-standard port, such as 2222.
Why it fails: Changing the SSH port is a form of security through obscurity. It may reduce automated scanning noise but does not provide real security benefits, as attackers can easily scan for open ports. It can also complicate firewall rules and legitimate access. While sometimes used, it is not considered a best practice for reducing attack surface compared to disabling root login and using key-based authentication. Therefore, it is not one of the two best actions.
B
Disable password authentication by setting PasswordAuthentication no and use SSH keys.
Disabling password authentication and requiring SSH keys eliminates the risk of brute-force password attacks. Keys are much harder to guess or crack, and they can be protected with passphrases. This is a fundamental SSH hardening measure. It directly reduces the attack surface by removing a common vector for unauthorized access. This action is strongly recommended for public-facing servers.
C
Enable password authentication to ensure only authorized users can log in.
Why it fails: Enabling password authentication is the opposite of hardening; passwords can be brute-forced or guessed. Best practice is to disable password authentication and use SSH key-based authentication, which is more secure. The scenario implies the server is public, so password authentication increases risk. This action would not reduce attack surface and is therefore incorrect.
D
Disable root login by setting PermitRootLogin no in /etc/ssh/sshd_config.
Disabling direct root login forces administrators to log in with a regular user account and then escalate privileges using sudo or su. This reduces the risk of brute-force attacks against the root account, which is a common target. It also provides an audit trail of who performed privileged actions. This is a widely recommended SSH hardening step and directly addresses the scenario's goal of reducing attack surface.
E
Allow SSH access from any IP address to ensure administrators can connect from anywhere.
Why it fails: Allowing SSH from any IP address increases the attack surface by exposing the service to the entire internet. Best practice is to restrict SSH access to specific management subnets or IP addresses using firewall rules or TCP wrappers. This limits the number of potential attackers. The scenario's goal is to reduce attack surface, so this action is counterproductive and incorrect.

Question 3mediummultiple choice

A server hosts a database that requires nightly backups. The backup strategy uses a full backup every Sunday and differential backups on other days. On Wednesday, the server fails. Which backup sets are required to restore to the most recent state?

Trap 1: Last full backup and all differential backups since Sunday

Each differential backup already contains all changes since Sunday's full, so Monday's and Tuesday's sets are redundant; only the most recent differential is needed. Restoring every differential since Sunday is the correct procedure for incremental backups, which chain sequentially.

Trap 2: Last full backup only

Differential backups capture every change since the last full backup, so Wednesday's set already contains Monday's and Tuesday's data; restoring the full alone loses those days. A full backup by itself is the correct restore set only when the strategy uses full backups exclusively.

Trap 3: Last full backup and all incremental backups since Sunday

The strategy uses differential backups, not incremental ones, so no incremental sets exist to restore. Applying a full plus all incrementals since Sunday is the correct procedure when each backup captures only changes since the previous backup, requiring the whole chain.

A
Last full backup and all differential backups since Sunday
Why it fails: Each differential backup already contains all changes since Sunday's full, so Monday's and Tuesday's sets are redundant; only the most recent differential is needed. Restoring every differential since Sunday is the correct procedure for incremental backups, which chain sequentially.
B
Last full backup only
Why it fails: Differential backups capture every change since the last full backup, so Wednesday's set already contains Monday's and Tuesday's data; restoring the full alone loses those days. A full backup by itself is the correct restore set only when the strategy uses full backups exclusively.
C
Last full backup and the latest differential backup
Differential backups capture every change since the last full backup, so only the most recent differential is needed. Restoring requires the last full backup plus that latest differential, which returns the database to its Wednesday state.
D
Last full backup and all incremental backups since Sunday
Why it fails: The strategy uses differential backups, not incremental ones, so no incremental sets exist to restore. Applying a full plus all incrementals since Sunday is the correct procedure when each backup captures only changes since the previous backup, requiring the whole chain.

Question 4mediummultiple choice

A server administrator is troubleshooting a production server that boots successfully but intermittently reboots without warning. The IPMI event log shows no thermal or power events, and the OS logs show nothing before each reset. The administrator suspects a hardware fault and wants to capture the most detailed low-level diagnostic information the next time the server hangs or resets. Which of the following should the administrator configure to BEST collect this data?

Trap 1: Enable the baseboard management controller's System Event Log (SEL)…

Raising the SEL severity threshold would filter out the very events needed to diagnose an unexplained reset, making the log less useful rather than more. The SEL already captures platform events such as power and thermal conditions, and the scenario states those entries are absent. This setting does not capture CPU, memory, or firmware-level fault data that occurs before an unexpected reboot, so it does not meet the goal.

Trap 2: Enable the BMC's integrated management log and configure chassis…

Chassis intrusion detection reports physical access to the enclosure and does not record CPU, memory, or bus faults that could cause an unexpected reboot. The integrated management log is largely a subset of the SEL already reviewed. Neither capability captures the detailed pre-reset hardware telemetry the administrator needs, so this configuration would not surface the root cause.

Trap 3: Configure a memory dump of the operating system kernel to be…

A kernel memory dump only captures OS-visible state at the moment of a bug check, so it is useful for software faults but not for a silent hardware reset that leaves no OS log entry. Because the server reboots with no OS-level record, the dump would likely never be generated. This option addresses the wrong layer of the stack for a suspected hardware fault.

A
Enable the baseboard management controller's System Event Log (SEL) with a higher severity threshold
Why it fails: Raising the SEL severity threshold would filter out the very events needed to diagnose an unexplained reset, making the log less useful rather than more. The SEL already captures platform events such as power and thermal conditions, and the scenario states those entries are absent. This setting does not capture CPU, memory, or firmware-level fault data that occurs before an unexpected reboot, so it does not meet the goal.
B
Enable the BMC's integrated management log and configure chassis intrusion detection alerts
Why it fails: Chassis intrusion detection reports physical access to the enclosure and does not record CPU, memory, or bus faults that could cause an unexpected reboot. The integrated management log is largely a subset of the SEL already reviewed. Neither capability captures the detailed pre-reset hardware telemetry the administrator needs, so this configuration would not surface the root cause.
C
Enable the platform's crash dump or NMI-on-hang feature so hardware state is saved on the next fault
A platform crash dump triggered by an NMI or hang detection captures processor, memory controller, and firmware state at the instant of failure, which is exactly the low-level data missing from the SEL and OS logs. This is the correct tool when resets occur with no OS or SEL trace, because it records state before the platform restarts and overwrites volatile information.
D
Configure a memory dump of the operating system kernel to be written to a dedicated dump partition
Why it fails: A kernel memory dump only captures OS-visible state at the moment of a bug check, so it is useful for software faults but not for a silent hardware reset that leaves no OS log entry. Because the server reboots with no OS-level record, the dump would likely never be generated. This option addresses the wrong layer of the stack for a suspected hardware fault.

Question 5hardScenario

A mid-sized e-commerce company experienced a ransomware attack that encrypted all on-premises servers and their locally attached backup storage. The attack occurred on a Friday evening; the company was closed over the weekend. By Monday morning, the IT team discovered the encryption and found a ransom note demanding $500,000 in Bitcoin. The company has a disaster recovery plan that calls for restoring from daily tape backups stored offsite. However, the most recent offsite tape was taken home by a backup operator for the weekend and has not been returned. The tape contains full backups from Wednesday. The IT team has clean installation media and application software available. The company's RPO is 24 hours, and RTO is 48 hours. Management wants to minimize data loss and avoid paying the ransom. Based on this scenario, which of the following should the IT team do to recover the business operations?

Trap 1: Pay the ransom to obtain the decryption key, then restore the…

Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.

Trap 2: Rebuild the servers from scratch using clean media, and manually…

Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.

Trap 3: Wait for the backup operator to return the tape, then restore from…

This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.

A
Pay the ransom to obtain the decryption key, then restore the environment, and implement better security controls.
Why it fails: Paying the ransom encourages criminal activity, provides no guarantee of data recovery, and does not align with best practice incident response.
B
Rebuild the servers from scratch using clean media, and manually re-enter transactions since the last good backup based on paper records and customer emails.
Why it fails: Manual transaction re-entry is extremely time-consuming, highly error-prone, and would likely miss much data, causing severe business impact and exceeding the RTO.
C
Wait for the backup operator to return the tape, then restore from that tape, accepting data loss since Wednesday.
Why it fails: This passive approach creates unnecessary downtime and may exceed the RTO if the operator is delayed, and still results in significant data loss.
D
Rebuild the servers from scratch using clean media, restore the latest offsite tape if available, and apply available transaction logs from the on-premises backup server that was encrypted (attempting to recover unencrypted logs).
This approach maximizes data recovery by using the safest restoration method, leveraging existing backups, and attempting to salvage recent data from logs that may not have been encrypted.

Question 6mediummultiple choice

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

Trap 1: Install a passive infrared motion sensor inside the cage that…

A motion sensor detects that someone is present but cannot identify who entered or produce a per-person audit trail. It may generate nuisance alerts and provides no authentication or entry/exit timestamps tied to individuals. This option addresses intrusion detection, not the required identity-based access logging for the cage.

Trap 2: Replace the mesh door with a solid steel door and issue a…

A solid door and mechanical keys improve physical deterrence, but keys can be duplicated and shared, and a mechanical lock produces no record of who entered or when. The scenario specifically requires logging of individual entries and exits, which a keyed lock cannot provide. This option addresses deterrence only, not the audit requirement.

Trap 3: Place a security guard at the cage entrance during all business…

A guard can observe and log entries, but the requirement explicitly states the control must work without requiring a guard, and a guard is also costly and unavailable after hours. Human logging is error-prone and not tied to an authentication event. This option fails the 'without requiring a guard' constraint and provides weaker, non-automated records.

A
Install a passive infrared motion sensor inside the cage that triggers an alert whenever movement is detected.
Why it fails: A motion sensor detects that someone is present but cannot identify who entered or produce a per-person audit trail. It may generate nuisance alerts and provides no authentication or entry/exit timestamps tied to individuals. This option addresses intrusion detection, not the required identity-based access logging for the cage.
B
Install a biometric fingerprint reader on the cage door that records each authorized entry and exit in an audit log.
A biometric reader authenticates the specific individual and creates a timestamped audit trail of each entry and exit, satisfying both the access-control and logging requirements without a guard. Fingerprints are difficult to share or forge, so the log reliably identifies who entered. This directly meets the stated need for per-person entry/exit records in a colocation cage.
C
Replace the mesh door with a solid steel door and issue a mechanical key to each authorized employee.
Why it fails: A solid door and mechanical keys improve physical deterrence, but keys can be duplicated and shared, and a mechanical lock produces no record of who entered or when. The scenario specifically requires logging of individual entries and exits, which a keyed lock cannot provide. This option addresses deterrence only, not the audit requirement.
D
Place a security guard at the cage entrance during all business hours to visually verify and log each person who enters.
Why it fails: A guard can observe and log entries, but the requirement explicitly states the control must work without requiring a guard, and a guard is also costly and unavailable after hours. Human logging is error-prone and not tied to an authentication event. This option fails the 'without requiring a guard' constraint and provides weaker, non-automated records.

Question 7hardmultiple choice

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

Trap 1: An RTO of 30 minutes and an RPO of 15 minutes, supported by a cold…

This reverses the required metrics: the business needs recovery within 15 minutes and can tolerate 30 minutes of data loss. A cold site with tape backups typically requires hours to provision hardware and restore data, so it cannot meet a 15-minute recovery time objective even if the metrics were correct.

Trap 2: An RTO of 15 minutes and an RPO of 30 minutes, supported by a cold…

The metrics are correct, but a cold site with tape backups cannot meet a 15-minute recovery time objective. Cold sites require hardware installation, operating system deployment, and data restoration, which usually take far longer. The site strategy must match the aggressive recovery time requirement.

Trap 3: An RTO of 30 minutes and an RPO of 15 minutes, supported by a warm…

The warm site is a suitable strategy, but the metrics are reversed. The business requires recovery within 15 minutes and can accept 30 minutes of data loss. Using an RTO of 30 minutes would violate the recovery time requirement, and an RPO of 15 minutes is stricter than needed.

A
An RTO of 30 minutes and an RPO of 15 minutes, supported by a cold site with offsite tape backups.
Why it fails: This reverses the required metrics: the business needs recovery within 15 minutes and can tolerate 30 minutes of data loss. A cold site with tape backups typically requires hours to provision hardware and restore data, so it cannot meet a 15-minute recovery time objective even if the metrics were correct.
B
An RTO of 15 minutes and an RPO of 30 minutes, supported by a cold site with offsite tape backups.
Why it fails: The metrics are correct, but a cold site with tape backups cannot meet a 15-minute recovery time objective. Cold sites require hardware installation, operating system deployment, and data restoration, which usually take far longer. The site strategy must match the aggressive recovery time requirement.
C
An RTO of 30 minutes and an RPO of 15 minutes, supported by a warm site with replicated data.
Why it fails: The warm site is a suitable strategy, but the metrics are reversed. The business requires recovery within 15 minutes and can accept 30 minutes of data loss. Using an RTO of 30 minutes would violate the recovery time requirement, and an RPO of 15 minutes is stricter than needed.
D
An RTO of 15 minutes and an RPO of 30 minutes, supported by a warm site with replicated data.
The recovery time objective of 15 minutes matches the requirement to resume quickly, and the recovery point objective of 30 minutes matches the tolerable data loss. A warm site with replicated data can be brought online within that window, making this combination appropriate for the stated business requirements.

Question 8easymultiple choice

A server administrator is tasked with ensuring that a critical database server remains available in the event of a hardware failure. The solution must provide automatic failover with minimal administrative overhead. Which of the following should be implemented?

Trap 1: Load balancing

Load balancing distributes requests across servers but does not automatically fail over a database node or transfer its state; a failed node simply leaves the pool. It is tempting because it improves availability, and would be correct for stateless web tiers rather than a stateful database.

Trap 2: Scheduled backups

Scheduled backups restore data after an outage but do not provide automatic failover, and recovery requires manual intervention, contradicting minimal administrative overhead. It is tempting because backups protect data, and would be correct for disaster recovery or point-in-time restoration rather than continuous availability.

Trap 3: RAID 1 mirroring

RAID 1 mirrors disks within one server, so it survives a disk failure but not a server hardware failure, and provides no failover to another node. It is tempting because mirroring delivers redundancy, and would be correct when protecting against a single drive failure only.

A
Load balancing
Why it fails: Load balancing distributes requests across servers but does not automatically fail over a database node or transfer its state; a failed node simply leaves the pool. It is tempting because it improves availability, and would be correct for stateless web tiers rather than a stateful database.
B
Scheduled backups
Why it fails: Scheduled backups restore data after an outage but do not provide automatic failover, and recovery requires manual intervention, contradicting minimal administrative overhead. It is tempting because backups protect data, and would be correct for disaster recovery or point-in-time restoration rather than continuous availability.
C
RAID 1 mirroring
Why it fails: RAID 1 mirrors disks within one server, so it survives a disk failure but not a server hardware failure, and provides no failover to another node. It is tempting because mirroring delivers redundancy, and would be correct when protecting against a single drive failure only.
D
Server clustering
Server clustering links nodes so a surviving member automatically takes over the failed node's workload, delivering failover with minimal manual intervention. This satisfies the stem's automatic failover and low administrative overhead constraints, unlike standalone backups or manual restore procedures.

Question 9hardmultiple choice

A server administrator is configuring a RAID array on a new server with six 4 TB SAS drives. The server will host a large email archive that requires maximum usable capacity and can tolerate the loss of up to two drives without data loss. Write performance is not critical, but read performance should be adequate. Which RAID level should the administrator choose?

Trap 1: RAID 0

RAID 0 offers no redundancy and cannot tolerate any drive failure. It provides maximum capacity and performance, but a single drive failure would result in total data loss. The scenario requires tolerance of up to two drive failures, so RAID 0 is completely unsuitable.

Trap 2: RAID 5

RAID 5 can tolerate only one drive failure, not two. Although it offers good usable capacity (n-1 drives), it does not meet the requirement of surviving two simultaneous drive failures. In a large array of 4 TB drives, rebuild times are long, increasing the risk of a second failure during rebuild, so RAID 5 is not the best choice here.

Trap 3: RAID 10

RAID 10 can tolerate multiple drive failures as long as they are not in the same mirrored pair, but it only provides 50% usable capacity. With six 4 TB drives, that would be 12 TB, which is less than RAID 6's 16 TB. The scenario prioritizes maximum usable capacity, so RAID 10 is not the best fit despite its performance and redundancy.

A
RAID 0
Why it fails: RAID 0 offers no redundancy and cannot tolerate any drive failure. It provides maximum capacity and performance, but a single drive failure would result in total data loss. The scenario requires tolerance of up to two drive failures, so RAID 0 is completely unsuitable.
B
RAID 6
RAID 6 uses dual parity, allowing the array to survive two simultaneous drive failures. It provides usable capacity of n-2 drives, which for six 4 TB drives is 16 TB. This meets the requirements for maximum usable capacity (compared to RAID 10) and tolerance of two drive failures, while read performance is adequate for an email archive.
C
RAID 5
Why it fails: RAID 5 can tolerate only one drive failure, not two. Although it offers good usable capacity (n-1 drives), it does not meet the requirement of surviving two simultaneous drive failures. In a large array of 4 TB drives, rebuild times are long, increasing the risk of a second failure during rebuild, so RAID 5 is not the best choice here.
D
RAID 10
Why it fails: RAID 10 can tolerate multiple drive failures as long as they are not in the same mirrored pair, but it only provides 50% usable capacity. With six 4 TB drives, that would be 12 TB, which is less than RAID 6's 16 TB. The scenario prioritizes maximum usable capacity, so RAID 10 is not the best fit despite its performance and redundancy.

Question 10hardmultiple choice

A server administrator is adding a second CPU to a dual-socket server that currently has one CPU installed. The server boots with one CPU but fails to POST after the second CPU is installed. The administrator verifies the CPU is seated correctly and the socket is clean. Which of the following is the most likely cause?

Trap 1: The second CPU is not on the motherboard's qualified vendor list…

A CPU that is not on the qualified vendor list may cause instability or unsupported operation, but a failure to POST immediately after adding a second identical-socket CPU is more commonly linked to missing required components. QVL mismatches usually result in warnings or degraded features rather than a complete no-POST condition, so this is not the most likely cause in this scenario.

Trap 2: The server's power supply wattage is insufficient for two CPUs.

Insufficient power supply wattage usually causes shutdowns under load, random reboots, or failure to power on at all, rather than a consistent no-POST after adding a CPU. A single CPU already draws significant power, and many servers have headroom for a second CPU of the same class. Power capacity is less likely than missing CPU-associated memory to cause this specific failure.

Trap 3: The second CPU requires a different heatsink than the first CPU.

Heatsinks are generally matched to the socket and thermal design power, not to the CPU's position in the chassis. Using the same heatsink model for both sockets is normal practice and would not by itself cause a no-POST condition. Thermal issues would typically appear as overheating or throttling after boot, not as an immediate failure to POST during hardware initialization.

A
The second CPU is not on the motherboard's qualified vendor list for dual-socket operation.
Why it fails: A CPU that is not on the qualified vendor list may cause instability or unsupported operation, but a failure to POST immediately after adding a second identical-socket CPU is more commonly linked to missing required components. QVL mismatches usually result in warnings or degraded features rather than a complete no-POST condition, so this is not the most likely cause in this scenario.
B
The server's power supply wattage is insufficient for two CPUs.
Why it fails: Insufficient power supply wattage usually causes shutdowns under load, random reboots, or failure to power on at all, rather than a consistent no-POST after adding a CPU. A single CPU already draws significant power, and many servers have headroom for a second CPU of the same class. Power capacity is less likely than missing CPU-associated memory to cause this specific failure.
C
The second CPU requires a different heatsink than the first CPU.
Why it fails: Heatsinks are generally matched to the socket and thermal design power, not to the CPU's position in the chassis. Using the same heatsink model for both sockets is normal practice and would not by itself cause a no-POST condition. Thermal issues would typically appear as overheating or throttling after boot, not as an immediate failure to POST during hardware initialization.
D
The server requires memory to be installed in the slots associated with the second CPU before it will POST.
On dual-socket motherboards, each CPU has its own memory channels and slots. If no memory is populated in the slots mapped to the second socket, the system will fail to POST because that CPU cannot initialize its memory controller. Installing at least one DIMM per memory channel for the second CPU is required for a successful dual-socket boot.

Question 11easymultiple choice

A server administrator is replacing a failed hard drive in a server that uses a hardware RAID controller. The server supports hot-swappable drives. Which of the following should the administrator do FIRST to safely replace the drive?

Trap 1: Remove the drive immediately and replace it with a new one.

Removing a drive without identifying it first risks pulling the wrong drive, which could cause data loss or array failure. Even with hot-swap, the administrator must confirm which drive is failed. The RAID controller or drive LEDs provide this information. Replacing the wrong drive could degrade the array further. Always identify before removal.

Trap 2: Back up all data on the server before replacing the drive.

While backups are important, they are not the first step in a hot-swap replacement. The immediate concern is to identify the correct failed drive to avoid human error. Backing up could take hours and delay the replacement. In a RAID array, the data is still available, but the array is degraded. The priority is to replace the failed drive promptly to restore redundancy.

Trap 3: Power down the server and disconnect power cables.

Powering down is unnecessary and defeats the purpose of hot-swap capability. Hot-swappable drives are designed to be replaced while the server is running, minimizing downtime. Powering down would cause an outage and is not the first step. The administrator should instead verify the drive is ready for removal via the RAID controller interface before physically removing it.

A
Remove the drive immediately and replace it with a new one.
Why it fails: Removing a drive without identifying it first risks pulling the wrong drive, which could cause data loss or array failure. Even with hot-swap, the administrator must confirm which drive is failed. The RAID controller or drive LEDs provide this information. Replacing the wrong drive could degrade the array further. Always identify before removal.
B
Back up all data on the server before replacing the drive.
Why it fails: While backups are important, they are not the first step in a hot-swap replacement. The immediate concern is to identify the correct failed drive to avoid human error. Backing up could take hours and delay the replacement. In a RAID array, the data is still available, but the array is degraded. The priority is to replace the failed drive promptly to restore redundancy.
C
Power down the server and disconnect power cables.
Why it fails: Powering down is unnecessary and defeats the purpose of hot-swap capability. Hot-swappable drives are designed to be replaced while the server is running, minimizing downtime. Powering down would cause an outage and is not the first step. The administrator should instead verify the drive is ready for removal via the RAID controller interface before physically removing it.
D
Identify the failed drive using the RAID controller management utility or drive LEDs.
Before removing a drive, the administrator must positively identify the failed drive to avoid pulling a good drive and causing a second failure. RAID controllers provide management utilities (e.g., MegaRAID Storage Manager, iDRAC, or HPE Smart Storage Administrator) that show which physical drive is failed. Drive LEDs also indicate fault status. This step ensures the correct drive is replaced.

Question 12mediummulti select

A systems administrator is designing the backup strategy for a Windows Server 2022 file server that holds the company's only copy of active project data. The business requires that a single accidental deletion of a folder be recoverable quickly without a full restore, and that a ransomware event that encrypts the volume still leave a usable copy of the data. Which two actions should the administrator take to meet both requirements? (Choose two.)

Trap 1: Increase the NTFS permissions on the project folder so only senior…

Restricting delete rights reduces the chance of an accidental deletion by authorized staff, but it is a preventive control with no recovery capability. Once a file is gone, permissions do not bring it back. Ransomware executing under an account that already has write access can still encrypt or delete the folder, and the organization would be left with no usable copy. This does not satisfy either stated requirement.

Trap 2: Configure RAID 6 on the data volume to protect the project data…

RAID 6 tolerates the failure of two disk drives, which addresses hardware faults, not logical events. A deleted folder is deleted on every member of the array simultaneously, and ransomware that encrypts files does so through the file system, so the array mirrors the damage. RAID improves availability and should be present, but it cannot serve as a recovery mechanism for deletions or encryption.

Trap 3: Enable BitLocker with a TPM protector on the data volume to prevent…

BitLocker protects data confidentiality if a disk is physically removed or the server is stolen. It does not preserve historical versions of files and does not stop a running, authenticated process from encrypting data or deleting a folder. Since the threat model here is accidental deletion and ransomware executing on the live system, full volume encryption does not provide any recovery path and leaves both requirements unmet.

A
Increase the NTFS permissions on the project folder so only senior staff can delete files.
Why it fails: Restricting delete rights reduces the chance of an accidental deletion by authorized staff, but it is a preventive control with no recovery capability. Once a file is gone, permissions do not bring it back. Ransomware executing under an account that already has write access can still encrypt or delete the folder, and the organization would be left with no usable copy. This does not satisfy either stated requirement.
B
Configure a backup job that writes to a target that is offline or immutable, such as rotated removable media or a hardened repository with immutability enabled.
Ransomware commonly seeks out and encrypts reachable backup targets, so a copy that is offline or immutable at the time of attack remains intact. Rotated removable media is physically offline between jobs, and an immutable repository prevents deletion or modification for a retention period. This provides the clean recovery source the scenario demands after a volume-wide encryption event.
C
Enable Volume Shadow Copy Service on the data volume and schedule shadow copies several times per day.
Volume Shadow Copy Service creates point-in-time snapshots that users can browse through the Previous Versions interface, so a folder deleted by mistake can be restored in seconds without touching the backup media. Scheduling multiple shadow copies per day narrows the window of lost work. It addresses the fast single-deletion recovery requirement directly and is the standard Windows Server mechanism for that need.
D
Configure RAID 6 on the data volume to protect the project data against loss.
Why it fails: RAID 6 tolerates the failure of two disk drives, which addresses hardware faults, not logical events. A deleted folder is deleted on every member of the array simultaneously, and ransomware that encrypts files does so through the file system, so the array mirrors the damage. RAID improves availability and should be present, but it cannot serve as a recovery mechanism for deletions or encryption.
E
Enable BitLocker with a TPM protector on the data volume to prevent unauthorized access to the backups.
Why it fails: BitLocker protects data confidentiality if a disk is physically removed or the server is stolen. It does not preserve historical versions of files and does not stop a running, authenticated process from encrypting data or deleting a folder. Since the threat model here is accidental deletion and ransomware executing on the live system, full volume encryption does not provide any recovery path and leaves both requirements unmet.

Question 13hardmultiple choice

A technician is installing a new server with a hardware RAID controller. The server will host a database that requires high write performance and redundancy. The technician configures four SSDs in a RAID 10 array. After installation, the operating system reports the array as 1.2TB, but the technician expected 2.4TB. Which of the following explains the discrepancy?

Trap 1: The operating system is using a 512-byte sector size instead of 4K,…

Sector size affects performance and compatibility but does not halve the capacity. A 512e or 4Kn drive might have slightly different usable space due to overhead, but not a 50% reduction. This option misattributes the capacity loss to a formatting issue rather than RAID overhead.

Trap 2: The RAID controller is configured for RAID 5, which uses one drive…

RAID 5 with four drives would yield 75% of raw capacity (1.8TB if raw is 2.4TB), not 1.2TB. The scenario states RAID 10 was configured, so this option contradicts the given information. If the controller were mistakenly set to RAID 5, the capacity would be different, but the technician explicitly configured RAID 10.

Trap 3: The SSDs are not compatible with the RAID controller, causing a…

Incompatibility would typically result in the drives not being detected or errors, not a consistent 50% capacity reduction. The reported capacity is exactly half of the raw capacity, which is characteristic of RAID 10. This option is incorrect because it suggests a fault where none exists.

A
The operating system is using a 512-byte sector size instead of 4K, reducing usable capacity.
Why it fails: Sector size affects performance and compatibility but does not halve the capacity. A 512e or 4Kn drive might have slightly different usable space due to overhead, but not a 50% reduction. This option misattributes the capacity loss to a formatting issue rather than RAID overhead.
B
RAID 10 uses mirroring and striping, so only half of the raw capacity is available for data.
RAID 10 combines mirroring and striping. With four drives, data is mirrored across pairs, so the usable capacity is half of the total raw capacity. If each drive is 600GB, the raw capacity is 2.4TB, and the usable capacity is 1.2TB. This matches the reported size and is expected behavior for RAID 10.
C
The RAID controller is configured for RAID 5, which uses one drive for parity.
Why it fails: RAID 5 with four drives would yield 75% of raw capacity (1.8TB if raw is 2.4TB), not 1.2TB. The scenario states RAID 10 was configured, so this option contradicts the given information. If the controller were mistakenly set to RAID 5, the capacity would be different, but the technician explicitly configured RAID 10.
D
The SSDs are not compatible with the RAID controller, causing a size mismatch.
Why it fails: Incompatibility would typically result in the drives not being detected or errors, not a consistent 50% capacity reduction. The reported capacity is exactly half of the raw capacity, which is characteristic of RAID 10. This option is incorrect because it suggests a fault where none exists.

Question 14easymultiple choice

A server administrator is troubleshooting a server that fails to boot after a power outage. The server powers on, but no video is displayed, and the administrator hears a series of beeps. Which of the following should the administrator check FIRST?

Trap 1: The video card

A faulty video card could cause no video, but it would not typically produce beep codes unless the motherboard has an integrated speaker that beeps for video errors. However, memory errors are more common after power events and are a more likely cause of beep codes. Checking memory first is a better diagnostic step.

Trap 2: The power supply unit

While a power outage could damage the PSU, the server powers on and produces beeps, indicating that the PSU is likely providing power. The beep codes suggest a POST error, which is more likely related to hardware components like memory or video. Checking the PSU first would not address the beep code symptom.

Trap 3: The hard drive

Hard drive failures do not usually cause beep codes during POST; they would result in boot errors after POST completes. The absence of video and presence of beeps point to a pre-boot hardware issue, such as memory or CPU. Thus, checking the hard drive is not the first priority.

A
The video card
Why it fails: A faulty video card could cause no video, but it would not typically produce beep codes unless the motherboard has an integrated speaker that beeps for video errors. However, memory errors are more common after power events and are a more likely cause of beep codes. Checking memory first is a better diagnostic step.
B
The power supply unit
Why it fails: While a power outage could damage the PSU, the server powers on and produces beeps, indicating that the PSU is likely providing power. The beep codes suggest a POST error, which is more likely related to hardware components like memory or video. Checking the PSU first would not address the beep code symptom.
C
The memory modules
Beep codes during POST often indicate memory errors. After a power outage, memory modules can become unseated or damaged due to power surges. The administrator should reseat or replace memory modules and check the motherboard manual for the specific beep code pattern to confirm. This is a common first step for no-video, beeping servers.
D
The hard drive
Why it fails: Hard drive failures do not usually cause beep codes during POST; they would result in boot errors after POST completes. The absence of video and presence of beeps point to a pre-boot hardware issue, such as memory or CPU. Thus, checking the hard drive is not the first priority.

Question 15mediummultiple choice

A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The server uses a hardware RAID controller with a write-back cache. The administrator notices that the disk write throughput is significantly lower than expected during peak hours. Which of the following is the MOST likely cause?

Trap 1: The RAID array is rebuilding, consuming disk I/O resources.

A RAID rebuild would indeed consume I/O resources and slow performance, but the scenario does not mention any drive failure or rebuild activity. A rebuild is usually accompanied by alerts and would affect both reads and writes. The specific mention of write-back cache suggests a cache-related problem.

Trap 2: The server's power supply is insufficient, causing the disks to…

Insufficient power would likely cause more severe issues such as unexpected reboots or disk failures, not just slow write performance. Modern servers have redundant power supplies and monitoring that would alert on power issues. This is not a typical cause of degraded write throughput in a RAID array.

Trap 3: The file system is fragmented, causing excessive seek times.

File system fragmentation can degrade performance, but it typically affects both read and write operations and does not cause a sudden drop in write throughput. Moreover, fragmentation is less likely on a server with a hardware RAID controller and write-back cache, which abstracts the physical disk layout. The scenario points to a controller-level issue.

A
The RAID controller's battery backup unit (BBU) has failed, causing the controller to switch to write-through mode.
A failed BBU forces the RAID controller to disable write-back caching and default to write-through mode to prevent data loss during a power failure. This dramatically reduces write performance because each write must be committed to disk before completion. The scenario describes a sudden drop in write throughput, which is consistent with this behavior.
B
The RAID array is rebuilding, consuming disk I/O resources.
Why it fails: A RAID rebuild would indeed consume I/O resources and slow performance, but the scenario does not mention any drive failure or rebuild activity. A rebuild is usually accompanied by alerts and would affect both reads and writes. The specific mention of write-back cache suggests a cache-related problem.
C
The server's power supply is insufficient, causing the disks to spin down intermittently.
Why it fails: Insufficient power would likely cause more severe issues such as unexpected reboots or disk failures, not just slow write performance. Modern servers have redundant power supplies and monitoring that would alert on power issues. This is not a typical cause of degraded write throughput in a RAID array.
D
The file system is fragmented, causing excessive seek times.
Why it fails: File system fragmentation can degrade performance, but it typically affects both read and write operations and does not cause a sudden drop in write throughput. Moreover, fragmentation is less likely on a server with a hardware RAID controller and write-back cache, which abstracts the physical disk layout. The scenario points to a controller-level issue.

Question 16easymultiple choice

A technician is tasked with installing a new internal SSD into a server. The server will be used for a database that requires high write endurance. Which of the following SSD types should the technician choose?

Trap 1: TLC (Triple-Level Cell) SSD

TLC SSDs store three bits per cell, providing higher capacity at lower cost but with reduced endurance compared to MLC or SLC. They are common in consumer devices but less ideal for write-intensive enterprise databases. Endurance is further reduced as density increases. This makes TLC a poor choice for high write endurance.

Trap 2: MLC (Multi-Level Cell) SSD

MLC SSDs store two bits per cell, offering a balance between cost and endurance. They are suitable for general enterprise use but may not meet the high write endurance requirements of a write-intensive database. They have lower endurance than SLC or eMLC. For heavy write workloads, a more durable option is preferable.

Trap 3: QLC (Quad-Level Cell) SSD

QLC SSDs store four bits per cell, maximizing capacity but significantly reducing endurance and write performance. They are suited for read-intensive applications, not write-heavy databases. The lower endurance means they wear out faster under constant writes. QLC is not appropriate for high write endurance scenarios.

A
TLC (Triple-Level Cell) SSD
Why it fails: TLC SSDs store three bits per cell, providing higher capacity at lower cost but with reduced endurance compared to MLC or SLC. They are common in consumer devices but less ideal for write-intensive enterprise databases. Endurance is further reduced as density increases. This makes TLC a poor choice for high write endurance.
B
SLC (Single-Level Cell) SSD
SLC SSDs store one bit per cell, offering the highest write endurance and performance among NAND flash types. They are more expensive but are ideal for write-intensive workloads like databases. The higher endurance means they can withstand more write cycles before failure. This makes SLC the best choice for a database requiring high write endurance.
C
MLC (Multi-Level Cell) SSD
Why it fails: MLC SSDs store two bits per cell, offering a balance between cost and endurance. They are suitable for general enterprise use but may not meet the high write endurance requirements of a write-intensive database. They have lower endurance than SLC or eMLC. For heavy write workloads, a more durable option is preferable.
D
QLC (Quad-Level Cell) SSD
Why it fails: QLC SSDs store four bits per cell, maximizing capacity but significantly reducing endurance and write performance. They are suited for read-intensive applications, not write-heavy databases. The lower endurance means they wear out faster under constant writes. QLC is not appropriate for high write endurance scenarios.