Courseiva

CCNA Security Disaster Recovery Questions

75 of 110 questions · Page 1/2 · Security Disaster Recovery topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A company is implementing a disaster recovery plan and needs to determine the maximum acceptable amount of data loss measured in time. The business can tolerate losing up to 4 hours of transactions. Which metric should the administrator use to define this requirement?

A.Recovery Point Objective (RPO)
B.Recovery Time Objective (RTO)
C.Mean Time Between Failures (MTBF)
D.Mean Time To Repair (MTTR)
AnswerA

RPO defines the maximum acceptable amount of data loss measured in time. It indicates how far back in time a recovery must go, effectively determining backup frequency. A 4-hour RPO means backups or replication must occur at least every 4 hours to meet the business requirement.

Why this answer

The Recovery Point Objective (RPO) specifically quantifies the maximum tolerable data loss in terms of time. By stating that up to 4 hours of transactions can be lost, the business is defining an RPO of 4 hours. This metric directly drives backup frequency and replication intervals to ensure that no more than 4 hours of data is ever at risk.

Exam trap

The trap here is confusing RPO with RTO; RPO is about data loss (how much data you can afford to lose), while RTO is about downtime (how long you can afford to be offline).

Practice this question →
2
MCQhard

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

A.The backup solution did not support versioning.
B.The immutable storage policy was not configured correctly or had a retention lock that was not enabled.
C.The attacker used ransomware to encrypt the backup data at the source before it was sent.
D.The backup data was stored in a different geographic region than production.
AnswerB

Without a properly configured retention lock, even immutable storage may allow administrative deletions, defeating the purpose.

Why this answer

Option A is correct because true immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups.

Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

Practice this question →
3
MCQmedium

A security administrator at a financial services firm is implementing a defense-in-depth strategy for a new Windows Server 2022 file server that will host sensitive client data. The administrator needs to ensure that data at rest on the server's hard drives is protected in a way that does not require users to enter separate credentials and does not rely on the operating system's file permissions. Which technology should the administrator implement?

A.Storage Spaces with thin provisioning
B.Encrypting File System (EFS) on all user data folders
C.BitLocker Drive Encryption with TPM protector
D.NTFS permissions with inheritance enabled
AnswerC

BitLocker with a TPM protector encrypts the entire volume and automatically unlocks the drive during boot using the TPM, requiring no user interaction. This protects data at rest even if the physical drive is stolen, and it operates independently of NTFS permissions, satisfying the requirement for transparent, OS-independent protection.

Why this answer

BitLocker with a TPM protector provides full-disk encryption that is transparent to users and independent of file system permissions. The TPM stores the encryption key and releases it only during a verified boot process, so no separate credentials are needed. This directly addresses the need to protect data at rest on the server's drives without relying on NTFS.

Exam trap

The trap here is assuming that NTFS permissions or EFS alone can protect data at rest when the physical drive is removed from the server.

Practice this question →
4
MCQmedium

A company's datacenter is in a region prone to flooding. Management requires that a copy of nightly backups be stored where a regional flood cannot destroy both the production data and the backup copy, and that the copy be retrievable within 24 hours. Which strategy BEST meets these requirements?

A.Increase the RAID level on the production servers from RAID 5 to RAID 6.
B.Ship encrypted backup copies to an offsite vault in a different geographic region.
C.Replicate the backups to a tape library in a hardened rack in the same datacenter.
D.Configure an on-site disk-to-disk backup target and enable snapshots every four hours.
AnswerB

Storing encrypted copies at an offsite vault in another region ensures that a flood affecting the primary datacenter cannot destroy the backup media, and vault retrieval can be completed within the 24-hour window management requires. Encryption protects confidentiality while the media is in transit and at the vault.

Why this answer

The requirement is geographic separation of a backup copy so that a single regional flood cannot destroy production data and its backup, plus retrieval within 24 hours. Offsite vaulting in a different region satisfies both the survivability and recovery-time requirements, and encryption keeps the media safe while it is outside the organization's control.

Exam trap

The trap here is assuming that any redundant copy, such as RAID or a local disk target, counts as an offsite backup when it actually shares the same failure domain.

Practice this question →
5
MCQhard

A research institute stores regulated genomic data on a Windows Server 2022 file server. The IT director wants data at rest encrypted so that a stolen drive cannot be read, but the lab's instrument control software writes directly to the volume and cannot tolerate any interruption during long sequencing runs. The server has a TPM 2.0 module and a separate recovery appliance. Which solution should the administrator implement?

A.BitLocker with XTS-AES 256-bit encryption on the data volume, TPM protector plus a numerical password protector, and recovery keys escrowed to Active Directory.
B.Encrypting File System (EFS) applied to the top-level folder with a data recovery agent configured for the lab group.
C.NTFS permissions tightened to Administrators only, combined with auditing of all write operations to the volume.
D.Storage Spaces Direct with ReFS integrity streams enabled on the data volume and cluster shared volume encryption.
AnswerA

BitLocker encrypts the volume transparently below the file system, so the instrument software continues writing normally with no interruption. TPM plus a numerical password protector allows unattended boot while still providing an out-of-band recovery path, and escrowing the recovery key to Active Directory satisfies the requirement to recover data if the drive is moved to another system.

Why this answer

Full volume encryption is required, not file-level protection, because the threat is physical theft of the drive. BitLocker operates transparently beneath the file system, so the instrument software is unaffected, while TPM plus numerical password protectors and Active Directory escrow provide both unattended operation and a documented recovery path for regulated data.

Exam trap

The trap here is choosing a file-level or permission-based control when the stated threat is someone reading a drive after physically removing it from the server.

Practice this question →
6
MCQhard

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

A.The hard drive on the file server has failed
B.The backup software is not compatible with the current OS version
C.The full backup media is corrupted
D.The incremental backup chain is broken
AnswerD

Incremental backups depend on every prior increment plus the full backup; a missing or corrupt link in that chain leaves catalog references unresolvable. The restoration therefore fails with missing catalog files, matching a broken incremental chain.

Why this answer

Incremental backups depend on a chain that starts with a full backup and then each subsequent incremental backup references the previous one. If any link in the chain is missing, corrupted, or the catalog that tracks the chain is damaged, the restore fails with an error about missing catalog files. The most likely cause is that the incremental backup chain is broken, meaning the backup software cannot locate the required incremental sets to reconstruct the file server state.

Exam trap

SK0-005 often tests backup types and chain dependencies; candidates focus on physical media corruption or hardware failure, but the specific 'missing catalog' error points to a broken incremental chain.

How to eliminate wrong answers

Option A is wrong because a failed hard drive on the file server would cause the server to be unavailable or data loss at the source, but the error specifically mentions missing catalog files during restore, which points to the backup chain, not the source disk. Option B is wrong because backup software incompatibility with the OS version would typically cause the backup job to fail at creation time or produce a different error, not a missing catalog during restore. Option C is wrong because a corrupted full backup media would cause a read error or checksum failure on the full backup itself, not a missing catalog file error; the catalog is a separate index of the backup chain.

Practice this question →
7
MCQhard

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

A.Implement database replication to eliminate the database restore time.
B.Add more network bandwidth to speed up VM provisioning.
C.Use a warm site with pre-configured storage.
D.Automate application validation to reduce that phase by half.
AnswerA

Database replication keeps a standby copy continuously current, so failover removes the lengthy restore step from the recovery timeline. This directly attacks the dominant contributor to the RTO, satisfying the two-hour requirement more effectively than restoring from backup.

Why this answer

The exhibit timeline shows the database restore phase consuming the largest portion of recovery time. Implementing database replication (e.g., log shipping, Always On availability groups, or storage-level replication) keeps a standby copy continuously synchronized, so failover replaces a lengthy restore-from-backup with a near-instant switchover. This directly attacks the dominant contributor to RTO, bringing total recovery within the 2-hour business requirement.

Exam trap

The trap here is fixating on secondary timeline phases (validation, provisioning, bandwidth) instead of identifying the single dominant time consumer — candidates must read the exhibit and target the largest phase, not the easiest one to 'improve.'

How to eliminate wrong answers

Option B is wrong because network bandwidth affects VM provisioning transfer speed only marginally and does nothing to eliminate the multi-hour database restore that dominates the timeline. Option C is wrong because a warm site with pre-configured storage still requires restoring or rehydrating the database from backups, leaving the largest time sink intact. Option D is wrong because halving application validation only trims a small secondary phase and cannot compensate for the database restore time that pushes recovery past the 2-hour RTO.

Practice this question →
8
MCQhard

A company runs a critical SQL Server database on a physical server with a RAID 10 array. The database is backed up nightly to a local disk and replicated to a remote site every four hours. A ransomware attack encrypts the local database files and the local backup disk, but the remote replication target is unaffected. The administrator needs to restore service with the least data loss. Which recovery approach should the administrator use?

A.Restore the nightly backup from the local backup disk after running antivirus scans
B.Fail over to the remote site and continue running production there permanently
C.Rebuild the RAID 10 array and restore the database from the encrypted local files
D.Restore the most recent replicated backup from the remote site to a clean server
AnswerD

The remote replication target is unaffected by the ransomware, so it holds the most recent clean copy of the database, up to four hours old. Restoring it to a clean server avoids reinfection and minimizes data loss compared to older or compromised local copies. This directly addresses the least data loss requirement while ensuring a trusted source.

Why this answer

The remote replication target survived the attack and contains the most recent clean data, so restoring from it to a clean server minimizes loss and avoids reinfection. Local backups and database files are compromised. Rebuilding RAID does not decrypt data, and permanent failover is an architectural change beyond the immediate recovery need.

Exam trap

The trap here is assuming that RAID or a local backup provides protection against ransomware, when encryption of the files defeats both and only an isolated copy remains trustworthy.

Practice this question →
9
MCQmedium

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

A.Warm site
B.Alternate processing site
C.Cold site
D.Hot site
AnswerA

A warm site provides pre-installed hardware and network connectivity but lacks real-time replication, allowing activation within 24 hours. This satisfies the stem's recovery time objective while matching the requirement for regular, non-real-time data replication, unlike a hot site's continuous mirroring or a cold site's lengthy build-out.

Why this answer

Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks.

An alternate processing site is a vague term.

Practice this question →
10
MCQmedium

An administrator is configuring a server to use a hardware security module (HSM) for disk encryption key storage. The administrator wants to ensure that if the server is stolen, the encrypted disks cannot be decrypted even if the disks are moved to another system. Which statement best describes why the HSM supports this goal?

A.The HSM stores the keys in a plaintext file on the boot volume so the operating system can load them at startup.
B.The HSM encrypts the disks with a key that is embedded in the disk firmware, so the key travels with the disks.
C.The HSM synchronizes keys to a cloud service so any server can retrieve them after authenticating with a user password.
D.The HSM stores the encryption keys in a tamper-resistant device and releases them only to authorized systems, so removing the disks does not expose the keys.
AnswerD

An HSM protects cryptographic keys in tamper-resistant hardware and releases them only after authentication and authorization. When disks are moved to another system, the attacker lacks access to the HSM and its keys, so the data remains unreadable. This directly supports the goal of preventing decryption after theft.

Why this answer

An HSM protects keys in tamper-resistant hardware and releases them only to authorized systems after authentication. Because the keys never leave the HSM in usable form and are not stored on the disks, moving the disks to another system does not allow decryption. The other options either embed keys in the disks, expose them via cloud retrieval, or store them in plaintext.

Exam trap

The trap here is assuming that disk encryption alone protects data, when the real protection depends on where the keys are stored and whether they travel with the disks.

Practice this question →
11
Multi-Selecthard

A company is designing a disaster recovery plan for its primary datacenter. The plan must include a warm site that can take over production within four hours and must verify that the recovery procedures actually work. Which two elements should be included? (Choose two.)

Select 2 answers
A.A tabletop exercise that walks stakeholders through the recovery steps and identifies gaps in the plan.
B.A documented recovery time objective (RTO) of four hours and a recovery point objective (RPO) aligned with the replication schedule.
C.Biweekly incremental backups to tape stored only in the primary datacenter.
D.A full-scale failover test that shuts down the primary datacenter during business hours without notifying users.
E.A cold site with no pre-installed hardware or data replication, relying on emergency procurement during a disaster.
AnswersA, B

A tabletop exercise gathers stakeholders to discuss and walk through the disaster recovery plan step by step without disrupting production. It validates roles, communication paths, dependencies, and decision points, and it surfaces gaps such as missing contact information or unclear escalation procedures. Because the scenario requires verifying that recovery procedures work, a tabletop exercise is a low-risk, high-value validation method that complements the documented objectives.

Why this answer

A workable disaster recovery plan for a four-hour warm site takeover needs measurable objectives and validation. Documented RTO and RPO values define the acceptable downtime and data loss, guiding the warm site design and replication schedule. A tabletop exercise validates the plan by walking stakeholders through the procedures, revealing gaps without risking production.

The other options either describe a real outage, an inadequate cold site, or backups stored in a single failure domain, none of which support the stated recovery targets.

Exam trap

The trap here is treating any form of testing as acceptable, when an unannounced production shutdown is an actual outage rather than a safe validation, and confusing a cold site's capabilities with those of a warm site.

Practice this question →
12
MCQhard

A company has a primary data center and a warm site 50 miles away. The disaster recovery plan specifies a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The administrator is reviewing the backup and replication strategy. Which combination best meets these objectives?

A.Asynchronous replication every 10 minutes to the warm site with automated failover
B.Nightly full backups shipped to the warm site and restored during a disaster
C.Synchronous replication to the warm site with manual failover procedures
D.Daily differential backups to local storage and weekly full backups to tape stored offsite
AnswerA

Replication every 10 minutes meets the 15-minute RPO because at most 10 minutes of data is lost. Automated failover to the warm site can bring systems online within the 4-hour RTO, making this combination appropriate for the stated objectives.

Why this answer

Asynchronous replication every 10 minutes keeps data loss within the 15-minute RPO, and automated failover to a warm site can achieve the 4-hour RTO. This combination balances cost and performance without requiring synchronous replication over a long distance.

Exam trap

The trap here is equating synchronous replication with a better RPO without considering distance and latency, or assuming manual failover can meet a 4-hour RTO.

Practice this question →
13
MCQhard

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

A.Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.
B.Password-protect the tapes and keep them in a locked safe.
C.Store tapes in a fireproof safe and limit access to key personnel.
D.Use a bonded courier service for transportation.
AnswerA

Encryption renders stolen tape contents unreadable, directly defeating the unauthorised access the audit exposed. Restricting decryption keys to authorised personnel ensures the physical theft yields no usable customer data, satisfying the sensitive-data confidentiality constraint that physical offsite controls alone could not.

Why this answer

Encrypting backup data with strong encryption and restricting decryption keys to authorized personnel (A) is the most effective control because it renders stolen tapes unreadable. Even if physical controls fail — as they did here — the data remains confidential without the keys. This is the principle of cryptographic protection as a last line of defense for data at rest.

Exam trap

SK0-005 often tests the difference between physical controls (safes, couriers, locks) and cryptographic controls — candidates pick physical measures that fail once the media is in the attacker's hands.

How to eliminate wrong answers

Option B is wrong because password-protecting tapes and locking them in a safe are physical/access controls that were already defeated in this scenario; password protection on tape is often weak or vendor-specific and does not provide strong cryptographic assurance. Option C is wrong because a fireproof safe and limited access address physical threats (fire, theft) but not the confidentiality of data if the safe is breached — it does not protect data at rest. Option D is wrong because a bonded courier reduces transit risk but does nothing to protect data if the tapes are stolen at the destination facility, which is exactly what happened.

Practice this question →
14
Multi-Selecthard

A company is drafting a disaster recovery plan for its primary data center. The plan must address both the maximum tolerable data loss and the maximum tolerable downtime for critical systems. Which of the following metrics should the plan explicitly define to meet these requirements? (Choose two.)

Select 2 answers
A.Recovery service level (RSL)
B.Recovery point objective (RPO)
C.Mean time between failures (MTBF)
D.Mean time to repair (MTTR)
E.Recovery time objective (RTO)
AnswersB, E

RPO defines the maximum acceptable amount of data loss measured in time, such as one hour or fifteen minutes. It directly answers how much data the business can afford to lose and drives backup frequency and replication design. Including RPO in the disaster recovery plan ensures that the backup and replication strategy matches the tolerable data loss for critical systems.

Why this answer

The two metrics that directly express maximum tolerable data loss and maximum tolerable downtime are the recovery point objective and the recovery time objective. RPO sets the acceptable data loss in time, and RTO sets the acceptable downtime. Reliability and repair averages such as MTBF and MTTR describe failure and repair behavior but do not define business tolerance for loss or downtime.

Exam trap

The trap here is confusing reliability averages like MTBF and MTTR with the business-defined objectives RPO and RTO.

Practice this question →
15
MCQmedium

A datacenter administrator is reviewing physical security for a new server room. The company wants to ensure that only authorized personnel can access the racks and that any access attempts are logged. The room already has a locked door with a badge reader. Which of the following should the administrator implement to meet the requirements for rack-level security and auditing?

A.Implement a mantrap at the entrance to the server room.
B.Install electronic rack locks with badge readers and audit logging.
C.Install a biometric scanner on the server room door.
D.Place a security camera in the server room.
AnswerB

Electronic rack locks with badge readers provide per-rack access control and generate logs of who accessed which rack and when. This directly meets the requirements for rack-level security and auditing. It integrates with existing badge systems and provides a clear audit trail for compliance.

Why this answer

Rack-level security requires controls that restrict and log access to each rack. Electronic rack locks with badge readers provide both physical prevention and an audit trail tied to individual racks. Room-level controls like biometrics, cameras, or mantraps do not satisfy the requirement for rack-level access control and logging.

Exam trap

The trap here is choosing a stronger room-level control and assuming it covers rack-level requirements, when the scenario explicitly asks for rack-level security and auditing.

Practice this question →
16
MCQeasy

A small business runs a Windows Server 2022 domain controller and a member file server. The administrator must ensure that if a server's system disk fails, the server can be rebuilt quickly with its operating system, roles, and settings intact. Backups are currently taken with Windows Server Backup to a dedicated backup volume on the same server. Which change should the administrator make?

A.Enable Storage Replica between the system disk and the backup volume so the backup volume holds a live mirror of the operating system.
B.Convert the system disk to a RAID 1 mirror pair and continue storing backups on the existing backup volume.
C.Configure Windows Server Backup to store backups on a separate external disk or network share and schedule a bare-metal recovery backup including system state.
D.Create a scheduled task that copies the Windows folder to the backup volume each night and enable shadow copies on the system volume.
AnswerC

Backups stored on a volume inside the same server are lost when that server's disk fails, so the target must move off the box. A bare-metal recovery backup captures the operating system, roles, and configuration needed to rebuild the server, and system state inclusion preserves Active Directory and registry settings on the domain controller.

Why this answer

The core flaw is that the only backup copy shares a chassis with the data it protects. Moving backup storage to an external disk or network share and taking a bare-metal recovery backup with system state gives the administrator a copy that survives the server's failure and contains everything needed to rebuild it.

Exam trap

The trap here is treating local redundancy such as RAID or shadow copies as a backup, when both remain inside the same server that is expected to fail.

Practice this question →
17
MCQmedium

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

A.Configure the network share with SMB encryption only.
B.Use a dedicated NIC for backup traffic on an isolated VLAN.
C.Place the backup server in a physically locked cage with restricted access.
D.Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.
AnswerD

Pre-transfer encryption protects data confidentiality both in transit and at rest on the backup media.

Why this answer

Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest.

Option D is a physical security measure and does not encrypt the data.

Practice this question →
18
MCQmedium

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

A.Asynchronous replication every 15 minutes
B.Snapshot replication every hour
C.Backup replication nightly
D.Synchronous replication
AnswerD

Synchronous replication ensures that any write is committed to both replicas before being acknowledged, thus achieving RPO=0.

Why this answer

Option B is correct because synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots.

Backup replication nightly (Option D) can lose up to a day's data.

Practice this question →
19
MCQeasy

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

A.Continuous data protection (CDP) with synchronous replication.
B.A weekly full backup with daily differential backups.
C.A weekly full backup with hourly incremental backups.
D.A nightly full backup.
AnswerC

Hourly incrementals ensure that no more than 1 hour of data is lost (well within the 4-hour RPO) and have minimal impact on production because they only back up changed data.

Why this answer

Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup.

Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Practice this question →
20
Multi-Selecthard

A security team is hardening a fleet of Linux web servers that will be exposed to the internet. They want to reduce the attack surface and limit the impact of a compromised service account. Which two actions BEST support these goals? (Choose two.)

Select 2 answers
A.Configure the firewall to allow only ports 80 and 443 from any source and deny all other inbound traffic by default.
B.Store database credentials in a world-readable configuration file so all administrators can access them during outages.
C.Grant the web service account sudo rights with no password so administrators can troubleshoot quickly during incidents.
D.Disable SELinux or AppArmor on the servers so that application updates do not fail during deployment.
E.Run the web service under a dedicated non-privileged account and restrict its file permissions to only the directories it must read.
AnswersA, E

A default-deny inbound policy that permits only the required web ports dramatically reduces the exposed attack surface. Services such as SSH, database listeners, and management interfaces are no longer reachable from the internet, so an attacker cannot directly exploit them. This is a foundational host-hardening step for internet-facing servers and directly supports the goal of limiting what can be attacked.

Why this answer

Reducing attack surface means exposing only necessary ports and removing unnecessary services, while limiting impact means confining what a compromised process can do. A default-deny firewall with only web ports open and running the service as a restricted non-privileged account with minimal file access both serve those goals. Disabling mandatory access control, granting passwordless sudo, and exposing credentials all increase risk.

Exam trap

The trap here is treating administrative convenience, such as passwordless sudo or world-readable credentials, as acceptable hardening when it actually expands the impact of a compromise.

Practice this question →
21
Multi-Selectmedium

A datacenter administrator is hardening a new Windows Server 2022 host that will run a public-facing web application. The administrator needs to reduce the attack surface at the operating system level. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Enable the Windows Defender Firewall and create inbound rules that allow only the required web and management ports.
B.Grant all domain users local Administrator rights so that support staff can troubleshoot quickly.
C.Disable Windows Update on the server so that unexpected patches do not interrupt the web application.
D.Remove or disable unused server roles, features, and services that are not required by the web application.
E.Install a full desktop experience with all optional Windows features enabled to simplify future administration.
AnswersA, D

Enabling the host firewall and restricting inbound traffic to necessary ports reduces the number of services reachable from the network. This directly lowers the attack surface by blocking unused or unexpected listeners, which is a core operating system hardening step for a public-facing server.

Why this answer

Reducing the operating system attack surface means removing what is not needed and restricting what remains. Disabling unused roles and services removes exploitable code, while enabling the host firewall and limiting inbound rules controls network exposure. Together they shrink the set of reachable services and reduce the likelihood of a successful compromise.

Exam trap

The trap here is treating convenience features and broad administrative rights as harmless, when they actually expand the attack surface.

Practice this question →
22
PBQmedium

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A.Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.
B.Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.
C.Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.
D.Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.
AnswerD

Why this answer

Option A is correct because asynchronous block-level replication with a 15-minute lag directly meets the RPO, and combining it with automated failover scripts can achieve the 2-hour RTO without requiring a costly bandwidth upgrade. Option B would meet the requirements but the link upgrade and synchronous replication infrastructure exceed the budget. Option C fails the RPO (4-hour backups are too infrequent) and RTO (manual failover is 4 hours).

Option D uses application log shipping that is not comprehensive (misses other servers) and manual failover would not meet the RTO.

Practice this question →
23
MCQmedium

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

A.Sunday full only
B.Sunday full, Monday differential, Tuesday differential, Wednesday differential
C.Sunday full and Thursday differential
D.Sunday full and Wednesday differential
AnswerD

Correct. Wednesday's differential contains all changes since Sunday, so only these two files are required for a full restore.

Why this answer

A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since.

Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Practice this question →
24
MCQmedium

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

A.Store backups on an air-gapped or offline system.
B.Encrypt the backup data using AES-256.
C.Perform full backups daily instead of weekly.
D.Switch from differential to incremental daily backups.
AnswerA

Air-gapped backups are physically disconnected from the network, making them immune to remote ransomware attacks and ensuring data recoverability.

Why this answer

Option D is correct because air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable.

Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Practice this question →
25
MCQhard

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

A.Perform a full backup more frequently.
B.Implement automated integrity checks and periodic test restores.
C.Switch to disk-based backups exclusively.
D.Store backup tapes offsite only after verification.
AnswerB

Integrity checks (e.g., checksums) verify that backup data matches the expected state, and test restores confirm that the data can actually be recovered, addressing both media and logical corruption.

Why this answer

Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time.

Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Practice this question →
26
Multi-Selectmedium

A systems administrator is designing the backup strategy for a Windows Server 2022 file server that holds the company's only copy of active project data. The business requires that a single accidental deletion of a folder be recoverable quickly without a full restore, and that a ransomware event that encrypts the volume still leave a usable copy of the data. Which two actions should the administrator take to meet both requirements? (Choose two.)

Select 2 answers
A.Increase the NTFS permissions on the project folder so only senior staff can delete files.
B.Configure a backup job that writes to a target that is offline or immutable, such as rotated removable media or a hardened repository with immutability enabled.
C.Enable Volume Shadow Copy Service on the data volume and schedule shadow copies several times per day.
D.Configure RAID 6 on the data volume to protect the project data against loss.
E.Enable BitLocker with a TPM protector on the data volume to prevent unauthorized access to the backups.
AnswersB, C

Ransomware commonly seeks out and encrypts reachable backup targets, so a copy that is offline or immutable at the time of attack remains intact. Rotated removable media is physically offline between jobs, and an immutable repository prevents deletion or modification for a retention period. This provides the clean recovery source the scenario demands after a volume-wide encryption event.

Why this answer

The scenario pairs two distinct risks: a fast, granular recovery from an accidental deletion, and a clean copy surviving a ransomware event that compromises the live volume. Shadow copies handle the first by presenting browsable point-in-time versions on the same volume. An offline or immutable backup target handles the second, because the encrypted host cannot reach or alter that copy.

RAID and encryption improve availability and confidentiality but provide no restoration path.

Exam trap

The trap here is treating RAID or disk encryption as a backup, when neither preserves a historical copy that survives deletion or encryption of the live volume.

Practice this question →
27
PBQeasy

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A.Restore the server from the firm's cloud backup service for email.
B.Scan the USB drive with antivirus, then restore the latest differential backup from it.
C.Pay the ransom to obtain the decryption key, then perform a full backup.
D.Reimage the server, then restore data from the Friday offsite tape backup.
AnswerD

Why this answer

A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system.

Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery.

Thus, A is the safest and most reliable method.

Practice this question →
28
MCQmedium

A company is reviewing its disaster recovery plan. The plan currently states that a full backup is performed every Sunday and incremental backups are performed Monday through Saturday. A disaster destroys the primary server on Wednesday at 2:00 PM, after the Wednesday incremental backup has completed. The administrator needs to restore the server to the most recent state possible. Which of the following backup sets should the administrator restore?

A.The most recent full backup and all incremental backups since that full backup
B.The most recent full backup only
C.The most recent full backup and the most recent differential backup
D.The most recent full backup and the most recent incremental backup
AnswerA

With an incremental backup scheme, each incremental contains only the changes since the last backup of any type. To restore to the most recent state, the administrator must apply the last full backup followed by every incremental backup in sequence from Monday through Wednesday. This reconstructs all changes made since the full backup and yields the most recent recoverable state.

Why this answer

Incremental backups record only changes since the last backup, so a restore requires the last full backup plus every incremental in order. Restoring the full plus all incrementals since that full recreates the data as of the last incremental. Using only the latest incremental or only the full would lose data, and differential backups are not part of this schedule.

Exam trap

The trap here is confusing incremental with differential backups; assuming that the latest incremental contains all changes since the full backup leads to restoring an incomplete set and losing data.

Practice this question →
29
MCQeasy

A datacenter manager must protect a file server's data against a single hard disk failure while maximizing usable capacity. The server has four 4 TB drives and a hardware RAID controller. Which RAID level should be implemented?

A.RAID 5
B.RAID 0
C.RAID 1
D.RAID 6
AnswerA

RAID 5 stripes data and parity across all four drives, providing fault tolerance for one disk failure while losing the capacity of only one drive for parity. This yields approximately 12 TB of usable space, which is the highest usable capacity among the redundant options. It satisfies the requirement to survive a single disk failure and maximizes capacity, making it the appropriate choice for this file server.

Why this answer

The requirement is to survive one disk failure while maximizing usable capacity on four 4 TB drives. RAID 5 stripes both data and single parity across all members, so one drive's worth of capacity is lost to parity, yielding roughly 12 TB usable. It tolerates exactly one disk failure, matching the requirement, and provides more usable space than mirroring or double parity.

RAID 0 offers no redundancy, so it fails the fault-tolerance condition.

Exam trap

The trap here is assuming that any RAID level with redundancy is acceptable without evaluating the capacity trade-off, when the scenario specifically requires maximizing usable space while tolerating only a single failure.

Practice this question →
30
MCQeasy

A system administrator is configuring a RAID array for a database server that requires high fault tolerance and improved read performance. The array will consist of six 1 TB drives. The administrator wants to maximize usable capacity while being able to survive a single drive failure. Which RAID level should the administrator choose?

A.RAID 5
B.RAID 1
C.RAID 0
D.RAID 6
AnswerA

RAID 5 uses distributed parity across all drives, allowing the array to survive a single drive failure. With six 1 TB drives, usable capacity is 5 TB, maximizing capacity while providing fault tolerance. It also offers improved read performance through striping, making it suitable for the database server's requirements.

Why this answer

RAID 5 provides fault tolerance by surviving one drive failure and maximizes usable capacity by using only one drive's worth of space for parity. With six drives, it yields 5 TB usable, which is higher than RAID 6 or RAID 1. It also offers better read performance than a single drive or mirror, meeting the database server's needs.

Exam trap

The trap here is assuming that higher RAID numbers always mean better, or that RAID 6 is necessary for single-drive fault tolerance when RAID 5 already meets the requirement with more usable capacity.

Practice this question →
31
MCQhard

A security administrator is configuring disk encryption on a new file server that will store regulated data. The server has a TPM 2.0 chip and runs Windows Server 2022. The administrator wants to ensure that the encryption keys are protected and that the server can boot without requiring a USB key at every restart. Which configuration should the administrator use?

A.Enable BitLocker on the system volume and store the recovery key in Active Directory, using TPM-only protection.
B.Enable BitLocker with a startup PIN and store the PIN in a secure password vault.
C.Use EFS to encrypt the data folders instead of BitLocker, and back up the EFS certificate to a smart card.
D.Enable BitLocker with a USB startup key and keep the USB key plugged into the server at all times.
AnswerA

TPM-only protection allows the server to boot unattended because the TPM releases the volume master key after verifying boot integrity. Storing the recovery key in Active Directory provides a secure backup for recovery, meeting both unattended boot and key protection requirements.

Why this answer

BitLocker with TPM-only protection allows the server to start without user interaction because the TPM validates boot components and releases the key. Storing the recovery key in Active Directory ensures that administrators can recover access if the TPM changes or the volume becomes locked, satisfying both unattended boot and key protection.

Exam trap

The trap here is confusing startup authentication methods: a startup PIN or USB key adds manual steps, while TPM-only enables unattended boot but still requires a recovery key backup.

Practice this question →
32
Multi-Selecthard

A company is implementing a disaster recovery plan for its on-premises data center. The plan must include measures to ensure data integrity and availability during a site-wide power failure. Which two actions should be included in the plan? (Choose two.)

Select 2 answers
A.Schedule full backups to run only during business hours.
B.Deploy an uninterruptible power supply (UPS) for all critical servers and storage.
C.Enable write caching on all storage controllers without battery backup.
D.Configure RAID 0 on all database servers to improve performance.
E.Implement a generator with automatic transfer switch (ATS) to provide long-term power.
AnswersB, E

A UPS provides temporary battery power during an outage, allowing servers to shut down gracefully or ride through short outages. This prevents data corruption from sudden power loss and maintains availability until generators start or systems shut down cleanly. It is a fundamental component of power failure preparedness.

Why this answer

To ensure data integrity and availability during a site-wide power failure, a UPS provides immediate battery power for graceful shutdown or ride-through, while a generator with ATS supplies long-term power to keep systems operational. Together, they form a layered power protection strategy. Other options compromise data integrity or do not address power failure directly.

Exam trap

The trap here is selecting RAID 0 for performance or enabling write caching without battery backup, which actually increase the risk of data loss during a power failure.

Practice this question →
33
Multi-Selecthard

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Select 3 answers
A.Emergency contact and communication plan
B.Server hardware specifications
C.Test and exercise schedule
D.Network topology diagram
E.Business impact analysis (BIA)
AnswersA, C, E

An emergency contact and communication plan is essential because a DRP must specify who to notify, how, and in what order during an outage. It satisfies the stem's requirement for essential DRP elements by ensuring coordinated escalation and stakeholder updates, without which recovery actions stall and downtime extends unnecessarily.

Why this answer

Option A (Emergency contact and communication plan) is essential because a DRP must define who to notify, how to reach them, and the escalation paths during an incident, ensuring coordinated response across staff, management, and vendors. Option C (Test and exercise schedule) is essential because a DRP is only reliable if it is validated through regular drills, tabletop exercises, and simulations that reveal gaps and keep recovery time objectives (RTOs) and recovery point objectives (RPOs) achievable. Option E (Business impact analysis (BIA)) is essential because it identifies critical business functions, dependencies, and acceptable downtime, providing the foundation for recovery priorities and strategy selection within the DRP.

Option B (Server hardware specifications) is not a core DRP element; hardware details belong to asset inventories or build documentation and are too granular for the plan itself. Option D (Network topology diagram) is also not essential to the DRP; while useful as a supporting reference, the plan focuses on roles, procedures, priorities, and validation rather than detailed technical diagrams.

Exam trap

The trap is confusing supporting documentation (like hardware specs or network diagrams) with essential DRP elements; candidates might select them because they seem important, but the exam expects the core components: communication, testing, and BIA.

Practice this question →
34
MCQmedium

A company performs a full backup every Sunday and incremental backups Monday through Saturday. On Wednesday, a database file becomes corrupted. The administrator needs to restore the most recent version of the file prior to corruption. Which backup sets must be restored?

A.The most recent full backup and the most recent incremental backup only.
B.The most recent full backup and all incremental backups since that full backup.
C.The most recent differential backup.
D.The most recent full backup only.
AnswerB

Incremental backups capture only changes since the last backup of any type. To restore to the most recent state before corruption, the administrator must restore the last full backup and then apply each subsequent incremental backup in sequence. This ensures all changes are applied in the correct order. Restoring only the full backup would lose all changes made after Sunday, and restoring a single incremental would not include earlier changes.

Why this answer

With an incremental backup scheme, each incremental contains only the changes since the previous backup. To restore the most recent version of a file, the administrator must restore the last full backup and then apply every incremental backup in sequence. This reconstructs the file to its state just before corruption.

Restoring only a subset would result in missing data and potential inconsistency.

Exam trap

The trap here is thinking that restoring the full backup and only the latest incremental is sufficient; incremental backups are not cumulative, so all incrementals since the full backup are needed.

Practice this question →
35
MCQmedium

A datacenter administrator is preparing to decommission a rack of servers that stored customer financial records. Company policy requires that data be rendered unrecoverable before the servers leave the facility, and the servers will be resold to a third party. Which action best satisfies the policy?

A.Delete all partitions and format each drive with a quick format.
B.Remove the drives and store them in a locked cabinet on site.
C.Run the manufacturer's secure erase utility and verify completion on each drive.
D.Degauss the drives before returning them to the reseller.
AnswerC

A manufacturer secure erase overwrites or cryptographically erases the drive media and provides verification, rendering the financial records unrecoverable while leaving the drives usable for resale. This matches both the data destruction policy and the plan to resell the hardware.

Why this answer

The policy demands unrecoverable destruction of financial data while the hardware is resold. A manufacturer secure erase physically or cryptographically erases the media and can be verified, satisfying both goals. Quick formatting leaves recoverable data, locked storage does not destroy anything, and degaussing destroys the drives needed for resale.

Exam trap

The trap here is equating deleting partitions or quick formatting with data destruction, when those operations leave the original data blocks recoverable.

Practice this question →
36
MCQeasy

A technician is disposing of several decommissioned servers that previously stored customer financial records. The drives will leave the building. Which action BEST ensures the data cannot be recovered by anyone who obtains the drives?

A.Physically destroy the drives by shredding or degaussing them before disposal.
B.Format each drive with the operating system's quick format option.
C.Move the drives to a locked storage room until a future disposal decision is made.
D.Delete all files and empty the recycle bin on each drive.
AnswerA

Shredding physically reduces the media to fragments, and degaussing destroys the magnetic alignment on traditional magnetic drives, making recovery infeasible. This ensures that even a determined party who obtains the drives cannot reconstruct the financial records, which is the strongest guarantee available for media leaving the facility.

Why this answer

Because the drives contain regulated financial data and are leaving the facility, the disposal method must make recovery infeasible. Physical destruction through shredding or degaussing removes any possibility of reading the media, which is stronger than any software-based erasure and aligns with the requirement that the data cannot be recovered by a later holder.

Exam trap

The trap here is treating logical deletion or quick formatting as secure erasure, when both leave the original data blocks recoverable.

Practice this question →
37
Multi-Selectmedium

A datacenter manager is reviewing physical security controls for a server room. Which two controls are considered preventive measures against unauthorized physical access? (Choose two.)

Select 2 answers
A.Biometric lock
B.Security camera
C.Log monitoring
D.Visitor sign-in sheet
E.Access control vestibule
AnswersA, E

A biometric lock uses a unique physical characteristic, such as a fingerprint or iris scan, to authenticate individuals before granting access. It is a preventive control because it stops unauthorized persons from entering the server room unless they present valid biometric data. This directly prevents physical intrusion and is a common requirement for high-security areas, making it one of the correct preventive measures.

Why this answer

Preventive controls actively stop unauthorized access before it occurs. A biometric lock and an access control vestibule both require authentication and physically block entry, making them preventive. Security cameras and log monitoring are detective controls that record or detect events, and a visitor sign-in sheet is an administrative control that documents but does not prevent access.

Exam trap

The trap here is classifying detective controls such as cameras and log monitoring as preventive, when they only observe or record rather than stop unauthorized access.

Practice this question →
38
Multi-Selecthard

A company is designing a disaster recovery plan for a critical web application. The plan must ensure that the application can be recovered within a 4-hour recovery time objective (RTO) and that no more than 1 hour of data is lost. The application runs on virtual machines backed by a storage area network (SAN). Which two actions best support these objectives? (Choose two.)

Select 2 answers
A.Perform nightly full backups to tape and store the tapes offsite.
B.Configure the virtual machines to replicate to a secondary host every 15 minutes using hypervisor-based replication.
C.Enable daily snapshots on the primary SAN and retain them for 30 days.
D.Store a copy of the application installation media in a locked cabinet at the primary site.
E.Implement SAN-based replication to a secondary site with a 1-hour recovery point objective.
AnswersB, E

Hypervisor-based replication every 15 minutes keeps the secondary copy within the 1-hour RPO and allows rapid failover, supporting the 4-hour RTO. It complements SAN replication by providing an application-consistent or crash-consistent copy that can be powered on quickly.

Why this answer

Meeting a 1-hour RPO and 4-hour RTO requires a recent, ready-to-use copy of the data at a secondary location. SAN-based replication with a 1-hour RPO and hypervisor-based replication every 15 minutes both provide that. Nightly tape backups, primary-site snapshots, and local installation media either exceed the RPO or do not survive a site failure.

Exam trap

The trap here is selecting any backup or replication method without verifying that its interval and location actually satisfy both the 1-hour RPO and the 4-hour RTO.

Practice this question →
39
PBQhard

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

A.Pay the ransom to decrypt the differential backup
B.Restore from the Sunday full backup and Wednesday's differential backup
C.Reinstall the operating system and restore files from cloud storage
D.Restore using only Wednesday's differential backup
AnswerB

Why this answer

Differential backups capture all changes since the last full backup, so Wednesday's differential contains everything modified since Sunday. Restoring the Sunday full backup followed by Wednesday's differential recovers all data up to Wednesday night, which is the most recent uncorrupted recovery point available. Thursday's differential is encrypted and unusable, so Wednesday is the correct fallback.

Exam trap

SK0-005 often tests whether candidates understand that a differential backup cannot be restored without its parent full backup — the trap is picking 'restore Wednesday's differential only' or assuming Thursday's encrypted differential can somehow be used.

How to eliminate wrong answers

Option A is wrong because paying the ransom is never a recommended recovery strategy — it funds attackers, does not guarantee decryption, and violates most security policies. Option C is wrong because reinstalling the OS and restoring from cloud storage is unnecessary and assumes cloud copies exist; the scenario describes NAS-only backups, and this would cause far more data loss than Wednesday's differential. Option D is wrong because a differential backup cannot be restored alone — it requires the preceding full backup as its base, so restoring only Wednesday's differential would fail or produce an incomplete filesystem.

Practice this question →
40
MCQmedium

A financial services company runs a single physical server hosting a customer-facing web application. The security team must ensure that if an attacker modifies system binaries, the server can detect the change during a forensic investigation. Which technology should be implemented to meet this requirement?

A.Security information and event management (SIEM) with log correlation
B.Host-based intrusion prevention system (HIPS) with signature-based detection
C.Full disk encryption (FDE) using TPM-backed BitLocker
D.File integrity monitoring (FIM) using a tool such as Tripwire
AnswerD

FIM tools compute cryptographic hashes of critical files and compare them against a known-good baseline. Any unauthorized modification to system binaries changes the hash, alerting the security team. This directly satisfies the requirement to detect tampering during a forensic investigation, as the baseline and alerts provide evidence of what changed and when.

Why this answer

The requirement is to detect unauthorized changes to system binaries for forensic purposes. File integrity monitoring establishes a cryptographic baseline and alerts on any deviation, providing clear evidence of tampering. Other options focus on prevention, log aggregation, or data-at-rest protection, none of which directly detect binary modification with forensic detail.

Exam trap

The trap here is confusing real-time prevention with after-the-fact detection, assuming a HIPS or SIEM will automatically provide file integrity evidence.

Practice this question →
41
MCQmedium

A datacenter administrator must implement a backup strategy for a file server that holds 8 TB of active patient imaging data. The organization requires that a complete copy of the data be stored offsite weekly, and that the offsite copy be protected from accidental deletion or alteration for at least 30 days. The administrator has a 10 GbE connection to the remote site. Which of the following should the administrator configure to meet these requirements?

A.Configure a weekly full backup to a remote object storage bucket with a 30-day object lock in compliance mode.
B.Configure a weekly full backup to a remote iSCSI LUN and enable CHAP authentication on the target.
C.Configure a weekly full backup to a remote tape library and store the tapes in a secure offsite vault.
D.Configure a weekly full backup to a remote SMB share and enable versioning on the share.
AnswerA

Object storage with a compliance-mode object lock enforces WORM (write once, read many) retention for the specified period, meaning even the root account cannot delete or alter the objects before the lock expires. This directly satisfies the 30-day immutability and offsite retention requirement, and the 10 GbE link supports the weekly 8 TB transfer.

Why this answer

The requirement is for an offsite weekly full copy that cannot be deleted or altered for 30 days. Object storage with a compliance-mode object lock provides WORM immutability that even privileged users cannot bypass until the retention period ends. The 10 GbE link is sufficient for the weekly 8 TB transfer, and the remote bucket satisfies the offsite condition.

Exam trap

The trap here is assuming that any remote share or LUN with access controls provides immutability, when only a WORM-enforcing mechanism such as object lock in compliance mode guarantees retention against privileged deletion.

Practice this question →
42
MCQeasy

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to protect against a hard drive failure that would cause downtime. The server has four drive bays, all currently empty. The administrator needs a solution that provides redundancy and maximizes usable capacity while tolerating one drive failure. Which of the following should the administrator implement?

A.RAID 1 with two drives
B.RAID 5 with three drives
C.RAID 5 with four drives
D.RAID 0 with four drives
AnswerC

RAID 5 with four drives stripes data and parity across all four drives, tolerating one drive failure while using the full capacity of the array minus one drive's worth of parity. This maximizes usable capacity among the redundant options given the four available bays and meets the requirement to survive a single drive failure without downtime.

Why this answer

RAID 5 with four drives provides single-drive fault tolerance and uses all four bays, yielding usable capacity equal to three drives. RAID 0 offers no redundancy, RAID 1 with two drives wastes two bays, and RAID 5 with three drives leaves a bay unused. Therefore, four-drive RAID 5 best satisfies both redundancy and capacity maximization.

Exam trap

The trap here is choosing RAID 1 because it is simple and redundant, without considering that the scenario explicitly asks to maximize usable capacity and that four drive bays are available.

Practice this question →
43
MCQmedium

A data center administrator is hardening a newly racked Linux server that will host a customer-facing API. The security policy states that only HTTPS (TCP 443) should be reachable from the internet, and no other services should be exposed. The administrator wants the change to survive a reboot and be enforced by the kernel's packet filter. Which of the following should the administrator configure to meet these requirements?

A.Add a rule to /etc/hosts.deny that blocks all services except HTTPS.
B.Install fail2ban and configure a jail that bans any IP address that connects to a port other than 443.
C.Set SELinux to enforcing mode and create a custom policy that only permits the httpd_t domain to bind to port 443.
D.Configure nftables with a persistent ruleset that allows established connections and TCP 443, then drops all other inbound traffic.
AnswerD

nftables is the current Linux kernel packet-filtering framework that replaces iptables, and a ruleset saved with the nft command or the distribution's persistent service will be reloaded at boot. Allowing established connections plus TCP 443 and dropping the rest enforces the policy at the kernel level, which is exactly what the security policy requires for this API server.

Why this answer

A kernel-level, persistent packet filter is needed so that only TCP 443 is reachable and the policy survives reboots. nftables is the modern Linux netfilter interface, and a saved ruleset with a default drop and an allow for established connections and TCP 443 meets the requirement. Host-based access files, SELinux alone, and fail2ban do not provide the same default-deny enforcement.

Exam trap

The trap here is assuming that TCP wrappers or SELinux alone can replace a stateful packet filter for controlling which ports are reachable from the network.

Practice this question →
44
MCQmedium

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

A.RAID controller
B.RAM module
C.Hard disk drive
D.Power supply
AnswerC

Medium errors and failed sector reallocation are direct indicators of physical hard disk drive failure.

Why this answer

The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Practice this question →
45
Multi-Selectmedium

A company is implementing a backup strategy for a critical database server. The backup window is limited, and the database must remain available during backups. The administrator needs to ensure that transaction log backups are performed and that the database can be restored to a point in time. Which two actions should the administrator take? (Choose two.)

Select 2 answers
A.Configure the database to use the full recovery model.
B.Set the database to the simple recovery model to minimize log growth.
C.Detach the database during backups to ensure consistency.
D.Perform only full backups during the backup window and skip log backups.
E.Schedule transaction log backups at regular intervals.
AnswersA, E

The full recovery model is required for transaction log backups and point-in-time restore. Without it, the database may use simple recovery, which does not support log backups or restoring to a specific point in time, so this action is necessary for the stated requirements.

Why this answer

To support point-in-time restore and keep the database online, the administrator must use the full recovery model and schedule transaction log backups. The full recovery model preserves the log until it is backed up, and regular log backups capture changes and truncate the log, enabling restoration to a specific moment.

Exam trap

The trap here is thinking that simple recovery or full backups alone enable point-in-time restore; only the full recovery model with log backups provides that capability.

Practice this question →
46
MCQeasy

A system administrator is configuring a backup strategy for a small business. The business requires that backups be stored offsite to protect against physical disasters, and that backup data be encrypted both in transit and at rest. Which of the following backup solutions BEST meets these requirements?

A.Use a cloud backup service that encrypts data with AES-256 before transmission and stores it encrypted in the cloud.
B.Perform backups to a tape drive and store tapes in a remote vault, using hardware encryption on the tape drive.
C.Back up to a local external hard drive that is rotated weekly to a bank safe deposit box, using BitLocker encryption.
D.Configure a backup to a network-attached storage (NAS) device located in a different building on the same campus, using SMB signing.
AnswerA

A cloud backup service with client-side AES-256 encryption ensures data is encrypted before leaving the server (in transit) and remains encrypted at rest in the cloud. This meets both encryption requirements and provides offsite storage without manual intervention. It is a robust solution for small businesses needing secure, offsite backups.

Why this answer

The cloud backup service with AES-256 encryption ensures data is encrypted both before transmission and while stored, satisfying the encryption requirements. It also provides offsite storage inherently, protecting against physical disasters. Other options either lack encryption in transit, do not provide true offsite protection, or rely on manual processes that may not be reliable.

Exam trap

The trap here is assuming that any offsite backup method automatically includes encryption in transit, or that encryption at rest alone is sufficient.

Practice this question →
47
MCQhard

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

A.The cluster will automatically fail over to a third site because the witness server is unavailable.
B.The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.
C.The cluster will be offline until one of the nodes or the witness comes back online.
D.The cluster remains online because the nodes can communicate directly and form quorum without the witness.
AnswerC

With all three voting members down, there are zero votes, below the quorum majority. The cluster will not start until at least two members are available (e.g., both nodes, or one node and the witness).

Why this answer

With a two-node cluster plus a file share witness, quorum requires a majority of votes — 2 out of 3. When both nodes and the witness lose power simultaneously, no votes remain, so the cluster cannot achieve quorum and all clustered roles go offline. Availability is restored only when at least two of the three voting members (e.g., one node plus the witness, or both nodes) return.

Exam trap

SK0-005 often tests the misconception that dynamic quorum or node-to-node communication can preserve cluster availability when every voting member, including the witness, is offline — candidates forget that quorum fundamentally requires a majority of surviving votes.

How to eliminate wrong answers

Option A is wrong because a failover cluster cannot 'fail over to a third site' that does not exist — there is no third site in this scenario, and witness loss does not trigger site failover. Option B is wrong because dynamic quorum adjusts vote assignment only while nodes are still running and communicating; it cannot manufacture quorum when every voting member is powered off. Option D is wrong because two nodes alone do not constitute a majority of a three-vote cluster — with the witness down, the nodes have only 2 of 3 votes and cannot form quorum by themselves.

Practice this question →
48
MCQmedium

A hospital's server room has a raised floor and a dedicated UPS circuit. During a scheduled power maintenance window, the facilities team must cut utility power to replace a breaker panel. The UPS must keep the two domain controllers and the electronic medical records (EMR) database server running for at least 20 minutes so they can be gracefully shut down. Which configuration should the administrator verify FIRST to meet this requirement?

A.The UPS battery runtime at the current load and the load percentage relative to UPS capacity
B.The UPS network management card's SNMP community string and trap destination
C.The redundant power supply configuration of the servers connected to the UPS
D.The automatic voltage regulation (AVR) settings on the UPS
AnswerA

Runtime is a function of load versus battery capacity. If the connected load is near the UPS's maximum, the batteries may only provide a few minutes, not the required 20. Verifying actual runtime at the current load confirms whether the UPS can bridge the maintenance window and allow graceful shutdown of the domain controllers and EMR database server.

Why this answer

The deciding factor for surviving a planned utility cut is whether the UPS can supply the connected load for the required duration. Runtime depends on battery capacity and the actual load drawn by the domain controllers and EMR database server. Confirming runtime at current load is the only option that directly validates the 20-minute requirement before the maintenance window begins.

Exam trap

The trap here is assuming that any UPS with a network management card and healthy batteries will automatically provide the needed runtime regardless of how much load is connected.

Practice this question →
49
MCQmedium

A network administrator is configuring a RAID array for a new file server that will store large media files. The server has six 4 TB SAS drives. The administrator needs to maximize storage capacity while providing fault tolerance against a single drive failure. Which RAID level should be implemented?

A.RAID 5
B.RAID 10
C.RAID 0
D.RAID 6
AnswerA

RAID 5 uses block-level striping with distributed parity, requiring a minimum of three drives. With six 4 TB drives, usable capacity is 20 TB (5 drives worth), and it can survive one drive failure. This balances capacity and fault tolerance, making it ideal for the file server requirement.

Why this answer

RAID 5 offers the best balance of capacity and fault tolerance for the given requirements. With six 4 TB drives, it provides 20 TB of usable space and can withstand one drive failure. RAID 6 offers more fault tolerance but less capacity, while RAID 0 lacks fault tolerance and RAID 10 sacrifices too much capacity.

Therefore, RAID 5 is the correct choice.

Exam trap

The trap here is assuming that RAID 6 or RAID 10 is always better due to higher fault tolerance, but the requirement specifically asks to maximize capacity while tolerating a single drive failure.

Practice this question →
50
Multi-Selectmedium

A company operates a single data center with 40 physical servers and no secondary site. Management has approved a project to improve disaster recovery posture and wants the ability to restore critical workloads after a total site loss. The budget is limited, and the company already owns a large tape library and an offsite vault contract. Which two components should the administrator include in the solution? (Choose two.)

Select 2 answers
A.RAID 6 arrays on every production server to protect against multiple simultaneous drive failures.
B.A second UPS with extended battery modules installed in the same server room as the primary UPS.
C.A cloud-based warm standby environment running replicated virtual machines for all 40 servers with automatic failover.
D.Offsite rotation of backup media with documented chain-of-custody and retention schedules aligned to the recovery requirements.
E.A documented, tested recovery procedure that includes bare-metal restore steps and periodic restore validation from offsite media.
AnswersD, E

Media stored only in the data center is lost with the site. A formal rotation to the existing offsite vault, with chain-of-custody records and a retention schedule matched to recovery needs, guarantees a usable copy exists elsewhere. This is a low-cost change that leverages the vault contract the company already pays for and directly supports site-loss recovery.

Why this answer

With no secondary site and a constrained budget, the practical path is to ensure an offsite copy exists and that it can actually be used. Rotating media to the existing vault with proper custody records guarantees survivability, and documented, validated bare-metal restore procedures prove the organization can rebuild critical workloads from those media after losing the data center.

Exam trap

The trap here is equating local redundancy technologies such as RAID or extra UPS capacity with disaster recovery, when a total site loss defeats every control that lives inside the building.

Practice this question →
51
MCQhard

A datacenter administrator is planning a disaster recovery site for a critical application. The business requires that the application be able to resume within 15 minutes of a primary site failure, but the application can tolerate up to 30 minutes of data loss. Which combination of metrics and site strategy best fits these requirements?

A.An RTO of 30 minutes and an RPO of 15 minutes, supported by a cold site with offsite tape backups.
B.An RTO of 15 minutes and an RPO of 30 minutes, supported by a cold site with offsite tape backups.
C.An RTO of 30 minutes and an RPO of 15 minutes, supported by a warm site with replicated data.
D.An RTO of 15 minutes and an RPO of 30 minutes, supported by a warm site with replicated data.
AnswerD

The recovery time objective of 15 minutes matches the requirement to resume quickly, and the recovery point objective of 30 minutes matches the tolerable data loss. A warm site with replicated data can be brought online within that window, making this combination appropriate for the stated business requirements.

Why this answer

Recovery time objective defines how quickly service must be restored, while recovery point objective defines how much data loss is acceptable. The scenario requires an RTO of 15 minutes and an RPO of 30 minutes. A warm site with replicated data provides the pre-staged infrastructure and recent data needed to meet both targets.

Exam trap

The trap here is swapping RTO and RPO or assuming any offsite site can meet a short recovery time without considering how long hardware and data restoration take.

Practice this question →
52
MCQhard

A security team wants to reduce the impact of a compromised service account that is used by a scheduled backup application on a Windows server. The account currently has domain administrator rights. Which action BEST limits the blast radius while keeping backups functional?

A.Configure a longer, more complex password on the existing domain administrator account.
B.Enable BitLocker on the backup server's system volume.
C.Move the scheduled backup jobs to run under the local SYSTEM account on each server.
D.Replace the domain administrator account with a dedicated service account granted only the required backup privileges.
AnswerD

A dedicated service account scoped to only the backup-related privileges follows the principle of least privilege. If the credential is compromised, the attacker inherits only those limited rights instead of full domain administrator access, which directly shrinks the blast radius while the scheduled backups continue to run.

Why this answer

Least privilege is the controlling principle: a service account used by a backup application should hold only the rights the application needs and nothing more. Swapping the domain administrator credential for a scoped service account keeps backups operational while ensuring a compromise yields limited, contained privileges instead of domain-wide control.

Exam trap

The trap here is treating password hardening as equivalent to privilege reduction, when the real exposure is the excessive rights attached to the account.

Practice this question →
53
PBQhard

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A.Switch to daily full backups to a local NAS, which takes 8 hours.
B.Adopt real-time replication to a hot site located offsite.
C.Continue the current strategy but increase the frequency of differential backups to every 4 hours.
D.Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
AnswerD

Why this answer

B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO.

The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last.

Option D is cost-prohibitive. Thus, B is feasible and effective.

Practice this question →
54
MCQmedium

A datacenter administrator is hardening a newly racked server that will host a public-facing application. The security policy requires that all administrative access to the server use encrypted protocols and that remote interactive logons be limited to the secure shell. Which action best meets these requirements?

A.Disable Telnet and enable SSH, then restrict the firewall to TCP port 22 for management traffic.
B.Disable Telnet and enable RDP, then restrict the firewall to TCP port 3389 for management traffic.
C.Keep Telnet enabled but require administrators to connect through a VPN, and restrict the firewall to TCP port 23 from the VPN subnet.
D.Disable both Telnet and SSH, enable a serial console server, and require administrators to use out-of-band access for all management.
AnswerA

SSH encrypts the entire administrative session, including credentials and commands, and restricting the firewall to TCP 22 enforces that remote interactive logons occur only over the secure shell. Disabling Telnet removes the cleartext alternative, so the policy requirement for encrypted administrative access is satisfied without exposing additional management ports.

Why this answer

The policy names two conditions: encrypted administrative protocols and remote interactive logons limited to the secure shell. SSH meets both because it encrypts the session and is the secure shell itself, while disabling Telnet eliminates the cleartext option. Tightening the firewall to TCP 22 ensures no other remote interactive protocol can be used for management.

Exam trap

The trap here is assuming that any encrypted remote protocol, such as RDP over TLS, satisfies a policy that specifically requires SSH for administrative logons.

Practice this question →
55
MCQhard

A financial services company must retain backup data for seven years to satisfy regulatory requirements. The data is written once and never modified, and the company wants to minimize cost while ensuring the data cannot be altered or deleted before its retention period expires. Which storage solution best meets these requirements?

A.A high-performance SAN with daily snapshots
B.WORM tape or object storage with object lock
C.A RAID 6 array with monthly full backups
D.A cloud file share with versioning enabled
AnswerB

Write once read many (WORM) media and object storage with object lock enforce immutability for a defined retention period. They are cost-effective for long-term archival, and the data cannot be altered or deleted until the retention period expires, directly satisfying the regulatory and immutability requirements.

Why this answer

Regulatory retention with immutability requires media or services that physically or logically prevent modification and deletion. WORM tape and object storage with object lock provide this capability at low cost for infrequently accessed data. SAN snapshots, RAID arrays, and ordinary versioned file shares all allow deletion or alteration, so they cannot satisfy the requirement.

Exam trap

The trap here is confusing versioning or RAID redundancy with true immutability, when only WORM media or object lock enforces a non-deletable retention period.

Practice this question →
56
MCQeasy

A small office has a single physical server running Windows Server 2022 that hosts a file share and a print server. The administrator wants to ensure that if the server's operating system becomes corrupted, the server can be restored quickly to a working state. Which backup type should the administrator use?

A.Volume shadow copy
B.System state backup
C.Bare metal recovery backup
D.File-level backup of the file share only
AnswerC

A bare metal recovery backup captures the entire operating system, applications, and data, allowing a full restore to new or existing hardware without a preinstalled OS. This is the appropriate choice when the goal is to recover quickly from a corrupted operating system.

Why this answer

A bare metal recovery backup includes the operating system, applications, and data, enabling a complete restore even if the OS is corrupted. This meets the need to quickly return the server to a working state without a lengthy manual rebuild.

Exam trap

The trap here is confusing system state backups with full server recovery; system state covers critical OS components but not the entire OS volume.

Practice this question →
57
MCQmedium

A datacenter administrator manages a rack of servers that handle nightly batch processing. The company's security policy requires that all server hard drives be sanitized before disposal, and the drives previously contained customer PII. The administrator needs a method that renders the data unrecoverable and also allows the drives to be reused internally for non-sensitive test systems. Which of the following should the administrator use?

A.Use a software tool to overwrite every sector of each drive with a fixed pattern, then verify the overwrite.
B.Degauss each drive with a strong magnetic field and then relabel it for reuse.
C.Remove the platters from each drive and shred them, then install new drives in the test systems.
D.Perform a quick format on each drive using the operating system's disk management utility.
AnswerA

Overwriting every sector with a fixed pattern (such as zeros or random data) and verifying the write is a standard sanitization method that renders the previous PII unrecoverable while leaving the drive usable for non-sensitive internal systems. This satisfies the policy and supports reuse, unlike physical destruction or weaker logical methods.

Why this answer

The requirement is to sanitize drives that held PII while keeping them usable for non-sensitive purposes. Overwriting every sector with a fixed pattern and verifying the overwrite achieves both goals. Quick formatting leaves data intact, degaussing ruins the drives, and shredding platters destroys them, so only the overwrite method satisfies both sanitization and reuse.

Exam trap

The trap here is assuming that any method that makes data hard to read also satisfies sanitization policy, when the reuse requirement eliminates destructive techniques.

Practice this question →
58
Multi-Selecthard

A server administrator is hardening a newly deployed Linux web server that will be exposed to the internet. The security policy requires minimizing the attack surface and protecting authentication. Which two actions BEST align with that policy? (Choose two.)

Select 2 answers
A.Install a full desktop environment and remote GUI tools so administrators can avoid using the command line.
B.Disable all unused network services and close their associated ports using the host firewall.
C.Enforce key-based SSH authentication and disable password authentication for remote administration.
D.Configure SSH to permit direct root login with a strong password to simplify administration.
E.Set the firewall default policy to allow all inbound traffic, then block only known malicious source IP addresses.
AnswersB, C

Every listening service is potential attack surface, so disabling unused daemons and blocking their ports reduces the number of exploitable entry points. This directly supports minimizing attack surface. The host firewall enforces the closure even if a service is accidentally re-enabled, giving defense in depth for an internet-facing server, which matches the stated hardening policy.

Why this answer

Hardening an internet-facing server means shrinking what is reachable and strengthening how administrators authenticate. Disabling unused services and closing their ports removes unnecessary entry points, while enforcing key-based SSH and disabling password authentication removes the easiest credential attack path. The other choices either expand the attack surface, weaken privileged access, or rely on an ineffective blocklist model.

Exam trap

The trap here is treating convenience measures such as root login or a desktop GUI as acceptable hardening when they actually enlarge the attack surface.

Practice this question →
59
Multi-Selecthard

A company is hardening a publicly reachable Linux web server that runs an SSH service for administration. The security team wants to reduce the attack surface and enforce stronger authentication. Which two actions BEST accomplish this? (Choose two.)

Select 2 answers
A.Install a host-based intrusion detection system that alerts on suspicious SSH login patterns.
B.Require public key authentication and disable password-based SSH logins.
C.Disable direct root login over SSH and require administrators to authenticate with individual accounts.
D.Enable verbose logging of all SSH connection attempts to a remote syslog server.
E.Change the SSH service to listen on a non-standard port to hide it from scanners.
AnswersB, C

Public key authentication is far more resistant to brute-force and credential-stuffing attacks than passwords, and disabling password logins removes that entire class of attack. This enforces stronger authentication while preserving administrative access for users who hold authorized keys, which is exactly the hardening goal described.

Why this answer

The strongest reductions in SSH attack surface come from removing weak authentication paths and eliminating shared, highly privileged logins. Requiring public keys with password authentication disabled blocks brute-force approaches, while forbidding direct root login enforces named accounts and per-user accountability. Together they harden authentication and limit the impact of a single compromised credential.

Exam trap

The trap here is treating detection or obscurity measures, such as logging or port changes, as if they reduced exposure rather than merely observing it.

Practice this question →
60
MCQhard

A company operates a primary datacenter and a cold standby site. The disaster recovery plan states that the standby site must be able to take over within 8 hours, but the current plan requires rebuilding servers from bare metal and restoring data from tape, which takes 3 days. Which change best aligns the standby site with the stated recovery time objective?

A.Convert the standby site to a warm site with pre-staged hardware and replicated data.
B.Document the rebuild procedure in more detail and rehearse it quarterly.
C.Increase the frequency of tape backups from weekly to daily.
D.Add a second tape library at the cold site for parallel restores.
AnswerA

A warm site has hardware and data already in place, so recovery involves powering on systems and applying recent changes rather than rebuilding from bare metal. This reduces recovery time from days to hours, matching the 8-hour RTO while costing less than a fully active-active site.

Why this answer

The gap is recovery time, not recovery point. A warm site with pre-staged hardware and replicated data removes the bare-metal rebuild step, bringing recovery within hours. Backup frequency, extra tape libraries, and documentation improvements address data freshness or process quality but leave the multi-day hardware rebuild in place.

Exam trap

The trap here is treating a recovery point objective problem as a recovery time objective problem, so the fix addresses backup frequency instead of the time to rebuild infrastructure.

Practice this question →
61
PBQeasy

A small business has a single file server running Windows Server 2019. The server uses two internal SATA drives in a RAID 1 mirror for the operating system and data. The company's backup solution performs a full backup every night to an external USB hard drive, which is stored in the server room. The IT administrator recently noticed that the server's system volume is running low on space and decides to migrate the data to a larger drive. During the migration, the server crashes and will not boot. The administrator attempts to restore from the latest backup but finds that the backup drive is corrupted and cannot be read. The company has no offsite backups. What should the administrator have done to prevent this situation?

A.Regularly test backup restorations to verify data integrity.
B.Implement a RAID 5 array instead of RAID 1 for better redundancy.
C.Document the backup procedure and create a disaster recovery plan.
D.Use a cloud-based backup service with offsite storage.
AnswerA

Why this answer

The correct answer is D: Regularly test backup restorations to verify data integrity. The administrator assumed backups were valid without verification. Option A is wrong because RAID 1 provides redundancy but does not protect against corruption or accidental deletion; the issue here is backup corruption.

Option B is wrong because cloud backup is a good practice but not strictly required; the root cause is lack of backup testing. Option C is wrong because while documentation is helpful, it would not prevent data loss from a corrupted backup drive.

Practice this question →
62
PBQhard

A large enterprise uses a centralized backup solution with a backup server running Commvault. Backups are stored on a deduplicated disk array and replicated to a secondary site for disaster recovery. The company's security team detects ransomware activity that has encrypted several file servers. The backup administrator checks the backup repository and finds that the backup data is also encrypted because the backup service account had permissions to modify backup files, and the ransomware propagated to the repository. The last known good backup is from two weeks ago, which is too old for the organization's RPO of 24 hours. The backup administrator is under pressure to restore operations quickly. Which of the following should the administrator implement to prevent this from recurring?

A.Immutable backup storage and a dedicated service account with least-privilege access.
B.Encrypt all backup data at rest and in transit.
C.Require multi-factor authentication for the backup service account.
D.Air-gap the backup repository by disconnecting it from the network except during backup windows.
AnswerA

Why this answer

The correct answer is A: Implement immutable backup storage and use a separate service account with write permissions only during backup windows. Immutable backups cannot be modified or deleted by any user or process, including ransomware. Option B is wrong because air-gapping alone does not prevent access if the backup server is compromised; immutable storage is more robust.

Option C is wrong because while MFA is a good security practice, it does not protect backups that are already accessible with valid credentials. Option D is wrong because encryption of backup data protects it during transit or while stored, but does not prevent the ransomware from encrypting the files if the backup system is accessible.

Practice this question →
63
MCQeasy

A small business runs a single physical server that hosts a customer relationship management (CRM) application and its database. The owner wants a backup strategy that allows the server to be restored on different hardware if the original server fails completely. Which backup type should the administrator implement?

A.Incremental backup
B.Bare-metal backup
C.Differential backup
D.Full backup
AnswerB

A bare-metal backup captures the entire server, including the operating system, system state, applications, and data, in a format that can be restored to completely different hardware. This directly satisfies the requirement to rebuild the server on new hardware after a total failure. It typically uses a bootable recovery environment and injects the appropriate mass storage drivers during restore, making it the correct choice for hardware-independent recovery.

Why this answer

The owner needs the server to be recoverable on different hardware after a complete failure. A bare-metal backup captures the operating system, system state, applications, and data, and its restore process can inject drivers for the new hardware, allowing the server to boot on dissimilar equipment. Full, differential, and incremental backups protect data but do not by themselves provide hardware-independent operating system recovery.

Exam trap

The trap here is assuming that any full backup automatically provides bare-metal recovery, when in fact hardware-independent restore requires a backup type that includes the operating system and boot configuration.

Practice this question →
64
MCQmedium

A datacenter operator is reviewing physical security for a server room that houses backup tapes and network core switches. The room has a single wooden door with a mechanical lock, and the key is shared among the facilities staff. Which change should the administrator recommend FIRST to improve access control?

A.Add a second mechanical lock to the door to create two-key access
B.Install a security camera in the hallway outside the server room
C.Move the backup tapes to a locked cabinet inside the server room
D.Install an electronic access control system with individual credentials and an audit log
AnswerD

An electronic access control system replaces a shared mechanical key with unique credentials per person and records every entry. This provides accountability and revokes access immediately when someone leaves. For a room containing backup tapes and core switches, individual accountability and auditability are the most direct improvements to access control.

Why this answer

The fundamental weakness is that a single mechanical lock with a shared key provides no individual accountability and cannot be selectively revoked. An electronic access control system issues unique credentials and logs each entry, directly improving both prevention and audit. This is the first and most impactful change for protecting the tapes and core switches.

Exam trap

The trap here is choosing a detective control such as a camera or an additional physical barrier, rather than replacing the shared-key mechanism that causes the accountability gap.

Practice this question →
65
MCQhard

A security administrator is configuring a server to meet a requirement that all administrative access must use multifactor authentication and be encrypted in transit. The server runs Windows Server 2022. Which solution should the administrator implement?

A.Secure Shell (SSH) with public key authentication
B.Remote Desktop Gateway (RD Gateway) with multifactor authentication
C.Virtual Private Network (VPN) with preshared key authentication
D.Remote Desktop Protocol (RDP) with Network Level Authentication (NLA)
AnswerB

RD Gateway encapsulates RDP traffic in HTTPS, encrypting it in transit, and can be integrated with multifactor authentication providers such as Microsoft Entra MFA or third-party RADIUS solutions. This directly satisfies both requirements: encrypted administrative access and MFA enforcement. It also provides a single point of entry that can be monitored and controlled, making it the correct solution for secure remote administration of Windows Server 2022.

Why this answer

The requirement is for administrative access that is both encrypted in transit and protected by multifactor authentication. Remote Desktop Gateway with MFA encrypts RDP sessions over HTTPS and enforces a second authentication factor, meeting both conditions. RDP with NLA lacks MFA, SSH with public key is single-factor, and VPN with preshared key is also single-factor, so none of those fully satisfy the requirements.

Exam trap

The trap here is equating encryption with multifactor authentication, or assuming that any encrypted remote access method automatically includes a second factor when it does not.

Practice this question →
66
MCQmedium

A company stores nightly database backups on a dedicated backup server in the same data center as the production database. The security team wants to ensure that a ransomware infection on the production network cannot encrypt or delete the backup copies. Which control should the administrator implement?

A.Enable deduplication on the backup server to reduce storage consumption.
B.Increase the backup retention period from 30 days to 90 days on the existing backup server.
C.Add a second backup server in the same rack and replicate backups between the two servers.
D.Configure immutable snapshots or WORM storage on the backup repository and restrict network access to the backup server.
AnswerD

Immutable snapshots or write-once-read-many storage prevent backup data from being altered or deleted for a defined retention period, even by compromised administrative credentials. Restricting network access reduces the chance that ransomware can reach the repository in the first place, providing a strong defense against destructive attacks.

Why this answer

To survive ransomware, backups must be both isolated from the production network and protected from modification. Immutable or WORM storage prevents deletion or encryption even if administrative credentials are compromised, and network restrictions reduce the chance of the repository being reached. Retention or replication alone does not stop a destructive attack.

Exam trap

The trap here is assuming that more retention or a second copy automatically protects backups, without considering whether the copies are writable and reachable.

Practice this question →
67
PBQmedium

A medium-sized company runs an e-commerce platform on a cluster of three physical servers hosting virtual machines. The disaster recovery plan includes daily backups to a remote data center using Veeam Backup & Replication. The company's annual disaster recovery drill is scheduled for next week. During the drill, the IT team plans to simulate a complete site failure by powering off the primary data center. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. The team successfully restores the VMs at the remote site, but the application experiences significant performance degradation and many transactions fail due to database inconsistency. Investigation reveals that the backup was taken at 2:00 AM, but the failure occurred at 10:00 AM, and the application's database had transactions between 2:00 AM and 10:00 AM that were not captured. What should the IT team do to improve the recovery process?

A.Configure RAID 10 on all database servers to improve disk performance.
B.Upgrade the WAN connection between sites to reduce backup transfer times.
C.Enable log shipping with point-in-time recovery for the database.
D.Adjust the RTO to 8 hours to allow for more comprehensive backups.
AnswerC

Why this answer

The correct answer is B: Implement log shipping with point-in-time recovery for the database. The RPO of 1 hour is not being met because the backup schedule is daily. Option A is wrong because while a faster WAN can reduce backup time, the core issue is the backup frequency, not bandwidth.

Option C is wrong because the issue is not data redundancy but recovery granularity; RAID protects against drive failure but not data loss from missing transactions. Option D is wrong because increasing RTO does not solve the RPO violation; the goal is to reduce data loss, not relax the time target.

Practice this question →
68
MCQmedium

A system administrator needs to implement a secure method for remote administrators to manage servers in a data center. The solution must provide encrypted communication, support multi-factor authentication, and allow centralized logging of all administrative sessions. Which solution should be implemented?

A.Remote Desktop Protocol (RDP) with Network Level Authentication (NLA) and Group Policy
B.VPN with IPsec and RADIUS authentication
C.A jump server (bastion host) with SSH, MFA, and centralized session recording
D.SSH with key-based authentication and session logging via auditd
AnswerC

A jump server acts as a single entry point, enforcing MFA and logging all sessions centrally. It supports SSH for encrypted communication and can record sessions for auditing. This meets all requirements: encryption, MFA, and centralized logging. It also simplifies access management by consolidating connections.

Why this answer

A jump server with SSH, MFA, and centralized session recording provides encrypted access, enforces multi-factor authentication, and logs all administrative sessions in one place. This satisfies all requirements and is a common best practice for secure remote administration. Other options lack centralized session logging or are platform-specific.

Exam trap

The trap here is focusing only on encryption and MFA while overlooking the need for centralized logging of administrative sessions, which a jump server uniquely provides.

Practice this question →
69
MCQeasy

A system administrator must choose a backup method for a file server where the business requires that only files changed since the last backup are copied, and the backup window is very short. Which backup type should the administrator select?

A.Differential backup
B.Full backup
C.Synthetic full backup
D.Incremental backup
AnswerD

An incremental backup copies only the files that changed since the most recent backup of any type, which directly matches the requirement and keeps each run small. The short backup window is respected because the data set is minimal, though restores require the last full backup plus every incremental in sequence.

Why this answer

The requirement is to copy only files changed since the last backup while keeping the backup window short. An incremental backup captures exactly those changes, so each run is small and fast. Differential and full backups copy progressively more data, and a synthetic full produces a full image rather than a change-only copy.

Exam trap

The trap here is confusing incremental with differential; differential copies everything changed since the last full, not since the last backup of any type.

Practice this question →
70
MCQmedium

A datacenter administrator is reviewing physical security for a new colocation cage that houses servers containing regulated data. The cage has a locked mesh door, but the administrator must add a control that logs exactly which employee enters and exits, and when, without requiring a guard. Which solution BEST meets these requirements?

A.Install a passive infrared motion sensor inside the cage that triggers an alert whenever movement is detected.
B.Install a biometric fingerprint reader on the cage door that records each authorized entry and exit in an audit log.
C.Replace the mesh door with a solid steel door and issue a mechanical key to each authorized employee.
D.Place a security guard at the cage entrance during all business hours to visually verify and log each person who enters.
AnswerB

A biometric reader authenticates the specific individual and creates a timestamped audit trail of each entry and exit, satisfying both the access-control and logging requirements without a guard. Fingerprints are difficult to share or forge, so the log reliably identifies who entered. This directly meets the stated need for per-person entry/exit records in a colocation cage.

Why this answer

The requirement combines two needs: authenticate each individual and produce a timestamped record of entry and exit without human staffing. A biometric reader authenticates the specific person and writes each event to an audit log, so it satisfies both identity verification and automated logging. Mechanical keys, guards, and motion sensors each fail at least one of those needs in this colocation scenario.

Exam trap

The trap here is assuming that any physical lock on the cage satisfies access control, when the scenario specifically demands identity-based audit logging without a guard.

Practice this question →
71
MCQeasy

A financial services firm requires a disaster recovery solution that provides a Recovery Point Objective (RPO) of near zero and a Recovery Time Objective (RTO) of less than 2 hours. Which of the following site types is MOST appropriate?

A.Cloud-based backup with daily replication
B.Cold site
C.Warm site
D.Hot site
AnswerD

A hot site maintains near real-time synchronization and redundant hardware, allowing rapid failover with minimal data loss and downtime.

Why this answer

Option D is correct because a hot site is fully equipped, with near real-time data replication, enabling the fastest recovery and minimal data loss. A cold site (Option A) has the longest recovery time. A warm site (Option B) has some equipment but data must be restored from backup, increasing RTO and RPO.

Cloud-based backup with daily replication (Option C) does not meet near-zero RPO.

Practice this question →
72
MCQmedium

A company has a recovery point objective (RPO) of 15 minutes for its database server. The database is 500 GB, and the nightly full backup takes 4 hours. Which backup strategy best meets the RPO while minimizing storage and backup window impact?

A.Perform differential backups every 15 minutes
B.Perform a full backup every 15 minutes
C.Perform transaction log backups every 15 minutes
D.Perform incremental backups every 15 minutes
AnswerC

Transaction log backups capture all changes since the last log backup and can be scheduled every 15 minutes, directly meeting the 15-minute RPO. They are small and fast because they contain only the log records, not the entire database. Combined with a periodic full backup and possibly differential backups, this strategy minimizes storage and backup window impact while allowing point-in-time recovery. It is the standard method for databases requiring low RPO.

Why this answer

The RPO of 15 minutes means no more than 15 minutes of data can be lost. Transaction log backups run every 15 minutes capture all changes since the previous log backup, are small and fast, and support point-in-time recovery. Full backups every 15 minutes are impossible given the 4-hour runtime, while differential and incremental backups are less efficient or less granular for database recovery.

Exam trap

The trap here is assuming that any frequent backup meets the RPO, without considering that only transaction log backups provide the required granularity and efficiency for a database with a tight recovery point objective.

Practice this question →
73
MCQmedium

A systems administrator is configuring role-based access for a team of server operators. The operators need to restart services and view logs on production Linux servers, but they must not be able to edit configuration files or install packages. The administrator wants to implement this with the least privilege and avoid sharing the root password. Which of the following should the administrator configure?

A.Configure sudoers entries that allow each operator to run specific service management and log-reading commands without a password.
B.Deploy an SSH key pair for each operator and allow direct root login with the key.
C.Set the immutable attribute on configuration files and package directories so operators cannot modify them.
D.Create a shared operator account with a strong password and add it to the wheel group.
AnswerA

Sudoers can grant named users permission to run only specific commands, such as systemctl restart for approved units and journalctl for log viewing, while denying everything else. This follows least privilege, keeps individual accountability, and avoids sharing the root password. It directly matches the requirement that operators restart services and view logs but not edit configuration files or install packages.

Why this answer

Least privilege for this team means granting only the specific commands they need while keeping individual accountability. Sudoers entries that permit named operators to run approved service management and log-reading commands achieve this without sharing root credentials. Shared accounts with full sudo, immutable attributes, and direct root SSH all either over-privilege the operators or fail to provide the required controlled access.

Exam trap

The trap here is equating administrative access with full root or wheel group membership when a scoped sudo policy provides the needed commands with less risk.

Practice this question →
74
MCQhard

An administrator manages a Linux-based server hosting a database that contains regulated customer records. The security policy requires that when the server reaches end of life, all data on its solid-state drives be rendered unrecoverable before the drives leave the building. The server will be repurposed to a non-production test role within the same company rather than destroyed. Which action should the administrator take?

A.Run a single-pass overwrite of the entire drive with zeros using dd, then reinstall the operating system.
B.Delete all partitions, create a new partition table, and format the drives with a fresh file system before reuse.
C.Use the drive vendor's secure erase or cryptographic erase utility to reset the drives, then verify the result before reinstalling the operating system for the test role.
D.Encrypt the drives with LUKS using a new key and destroy the old key, keeping the drives encrypted for the test role.
AnswerC

Vendor secure erase commands, including cryptographic erase on self-encrypting drives, invalidate the stored data at the controller level and address over-provisioned and remapped cells that overwrite utilities cannot reach. Verifying the result before reuse confirms the data is gone, and the drives can then safely host the non-production test workload.

Why this answer

Solid-state drives remap logical blocks to physical cells, so overwriting every logical sector does not guarantee that copies in spare or retired cells are gone. A vendor secure erase or cryptographic erase resets the drive's internal encryption key or wipes all cells, including those outside the addressable range, and verification confirms the media is clean before it is reused.

Exam trap

The trap here is assuming that overwriting a solid-state drive works like overwriting a spinning disk, when the flash translation layer hides cells that software writes never touch.

Practice this question →
75
MCQeasy

A small business runs a single file server that stores contracts and financial records. The owner wants an affordable way to recover individual files that users accidentally delete or overwrite, with the shortest possible recovery time. Which solution BEST fits this requirement?

A.Enable Volume Shadow Copy Service snapshots on the file server so users can restore previous versions themselves.
B.Replicate the file server to a cloud VM every night and restore files from the cloud copy when needed.
C.Implement a RAID 5 array across three disks so that deleted files can be recovered from parity.
D.Configure a nightly full backup to an external USB drive that is stored in the office safe.
AnswerA

VSS snapshots capture point-in-time copies of volumes on a schedule, and the Previous Versions client lets users restore a deleted or overwritten file in seconds without administrator involvement. It is inexpensive because it uses local storage already present, and it directly targets accidental deletion and overwrite with the shortest recovery time.

Why this answer

The need is fast, low-cost recovery of individual files after accidental deletion or overwrite. Volume Shadow Copy Service keeps scheduled point-in-time snapshots on the server and exposes them through Previous Versions, so a user can restore a file in moments without administrator help. Nightly backups or cloud replication restore only to the last run and take longer, while RAID addresses disk failure rather than logical deletion.

Exam trap

The trap here is confusing RAID fault tolerance with backup, when RAID cannot recover a file that was deliberately or accidentally deleted.

Practice this question →
Page 1 of 2 · 110 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Security Disaster Recovery questions.

Start 20-question session