Courseiva

CCNA Troubleshooting Questions

45 of 120 questions · Page 2/2 · Troubleshooting topic · Answers revealed

Practice these questionsExam hubAll questions
76
MCQeasy

A server fails to boot with an 'Operating System Not Found' error. The BIOS detects the hard drive. What is the MOST likely cause?

A.Failed CPU
B.Incorrect memory timings
C.Overheating
D.Corrupted Master Boot Record
AnswerD

If the MBR is damaged or missing, the BIOS can detect the drive but cannot hand off to the OS bootloader.

Why this answer

Option B is correct because a corrupted Master Boot Record (MBR) can prevent the system from locating the OS loader even when the drive is detected by BIOS. Option A (incorrect memory timings) would typically cause POST failures, not a missing OS message. Option C (failed CPU) would prevent POST entirely.

Option D (overheating) would likely cause shutdowns before OS load.

Practice this question →
77
MCQeasy

A server administrator is troubleshooting a server that fails to boot after a power outage. The server powers on, but no video is displayed, and the administrator hears a series of beeps. Which of the following should the administrator check FIRST?

A.The video card
B.The power supply unit
C.The memory modules
D.The hard drive
AnswerC

Beep codes during POST often indicate memory errors. After a power outage, memory modules can become unseated or damaged due to power surges. The administrator should reseat or replace memory modules and check the motherboard manual for the specific beep code pattern to confirm. This is a common first step for no-video, beeping servers.

Why this answer

Beep codes during POST are a diagnostic tool used by motherboards to indicate hardware failures. Memory errors are a common cause, especially after a power outage that may have caused a surge or physical dislodging. The administrator should consult the motherboard manual for the beep code meaning and then reseat or replace memory modules.

Other components like PSU, video card, or hard drive are less likely to produce beep codes in this scenario.

Exam trap

The trap here is assuming the power supply is at fault because of the power outage, when the beep codes specifically point to a POST hardware error.

Practice this question →
78
Multi-Selecthard

A server administrator is troubleshooting a server that is experiencing slow performance. The administrator suspects a storage bottleneck. Which of the following tools or commands should the administrator use to identify the storage bottleneck? (Choose two.)

Select 2 answers
A.Performance Monitor (perfmon)
B.traceroute
C.ifconfig
D.netstat
E.iostat
AnswersA, E

Performance Monitor is a Windows tool that can collect and display a wide range of performance counters, including those for physical and logical disks. Counters such as Avg. Disk sec/Transfer and Disk Queue Length can indicate storage bottlenecks. In this scenario, using Performance Monitor to monitor these counters would help identify if the storage subsystem is the bottleneck. It is a standard tool for Windows server troubleshooting.

Why this answer

iostat and Performance Monitor are both capable of providing detailed storage performance metrics. iostat is used on Linux systems to show disk utilization and I/O statistics, while Performance Monitor is used on Windows to track disk counters. Both can help identify if a storage bottleneck exists by showing high disk queue lengths or high average disk response times. Network tools like netstat, traceroute, and ifconfig are not suitable for this task.

Exam trap

The trap here is confusing network troubleshooting tools with storage performance tools, especially since slow performance can have multiple causes.

Practice this question →
79
Multi-Selectmedium

A server administrator is troubleshooting a server that is exhibiting symptoms of overheating. The server is in a data center with proper cooling. Which of the following should the administrator check? (Choose two.)

Select 2 answers
A.Power supply wattage
B.Disk fragmentation
C.Airflow direction and blanking panels
D.CPU utilization
E.Fan speeds and operation
AnswersC, E

Proper airflow ensures cool air is drawn from the front and hot air is expelled from the rear. Missing blanking panels can cause recirculation of hot air, leading to overheating. The administrator should verify that all empty drive bays and PCIe slots have blanking panels and that the server is oriented correctly in the rack.

Why this answer

Overheating in a properly cooled data center often stems from server-specific cooling issues. Fan failures or degraded fan speeds directly reduce airflow, while improper airflow due to missing blanking panels or incorrect rack orientation can cause hot air recirculation. Both are common causes that should be checked.

Other factors like power supply wattage, CPU utilization, and disk fragmentation do not directly cause overheating in a cooled environment.

Exam trap

The trap here is focusing on workload or power components instead of the server's internal cooling mechanisms and airflow management.

Practice this question →
80
MCQmedium

A server administrator is troubleshooting a Linux server that is experiencing slow disk performance. The server uses a hardware RAID controller with a write-back cache. The administrator notices that the disk write throughput is significantly lower than expected during peak hours. Which of the following is the MOST likely cause?

A.The RAID controller's battery backup unit (BBU) has failed, causing the controller to switch to write-through mode.
B.The RAID array is rebuilding, consuming disk I/O resources.
C.The server's power supply is insufficient, causing the disks to spin down intermittently.
D.The file system is fragmented, causing excessive seek times.
AnswerA

A failed BBU forces the RAID controller to disable write-back caching and default to write-through mode to prevent data loss during a power failure. This dramatically reduces write performance because each write must be committed to disk before completion. The scenario describes a sudden drop in write throughput, which is consistent with this behavior.

Why this answer

A failed battery backup unit on a RAID controller forces the controller to disable write-back caching, switching to write-through mode. This ensures data integrity but severely impacts write performance because each write must be written directly to disk. The scenario's symptom of low write throughput during peak hours aligns with this behavior.

Other options like fragmentation or rebuild would not specifically target write performance or would present additional symptoms.

Exam trap

The trap here is assuming that any performance degradation is due to disk fragmentation or rebuild, overlooking the specific impact of a failed BBU on write caching.

Practice this question →
81
MCQhard

A server administrator is troubleshooting a Linux server that is experiencing intermittent network connectivity issues. Users report that connections to the server sometimes time out, and the administrator notices that the network interface card (NIC) is showing a high number of CRC errors and frame errors. Which of the following is the MOST likely cause?

A.An incorrect IP address configuration on the server.
B.The network switch port is configured for the wrong VLAN.
C.A duplex mismatch between the server NIC and the switch port.
D.A faulty or improperly terminated network cable.
AnswerD

CRC errors and frame errors typically indicate physical layer problems, such as a damaged cable, poor termination, or electromagnetic interference. These errors occur when frames are corrupted in transit, leading to retransmissions and timeouts. The most likely cause is a cabling issue, and replacing or re-terminating the cable should resolve the problem.

Why this answer

CRC and frame errors are indicators of physical layer issues, most commonly faulty cabling or connectors. The administrator should inspect and replace the network cable, and verify that the connectors are properly terminated. This should eliminate the errors and restore stable connectivity.

Exam trap

The trap here is attributing network errors to logical misconfigurations like IP or VLAN, when the specific error types point to physical layer problems.

Practice this question →
82
MCQhard

A server administrator is troubleshooting a Windows Server host that runs a database. Users report slow queries, and Performance Monitor shows sustained disk queue length above 2 with average disk sec/transfer over 25 ms on the data volume, while CPU and memory remain well below capacity. The volume resides on a hardware RAID 5 array of 7200 RPM SATA drives. Which of the following is the MOST likely cause?

A.CPU throttling due to thermal limits on the database server
B.Insufficient IOPS and write penalty from the RAID 5 array of slow SATA drives
C.Memory leak in the database process causing excessive paging
D.Network congestion between the database server and its clients
AnswerB

Sustained disk queue length above 2 with transfer latency over 25 ms indicates the storage subsystem cannot keep up with demand. A RAID 5 array of 7200 RPM SATA drives has limited random IOPS and incurs a read-modify-write penalty for small writes, which matches database workload patterns. CPU and memory being idle confirms the bottleneck is storage.

Why this answer

The measured latency and queue depth on the data volume, combined with idle CPU and memory, isolate the bottleneck to storage. A RAID 5 array built on 7200 RPM SATA drives delivers modest random IOPS and penalizes small writes with read-modify-write operations, which is exactly the pattern a database generates. Upgrading to SSDs or a RAID 10 layout addresses the root cause.

Exam trap

The trap here is attributing slow database queries to the application, CPU, or network when the disk counters already show the storage subsystem is the constrained resource.

Practice this question →
83
MCQmedium

A server administrator is troubleshooting a server that is experiencing slow response times. After logging in, the administrator runs the command 'iostat -x 5' on the Linux server and observes that the %util for the sda device is consistently at 100%. Which of the following is the MOST likely cause?

A.The CPU is overwhelmed and cannot process I/O requests fast enough.
B.The network interface card is dropping packets, causing retransmissions.
C.The server's memory is insufficient, causing excessive swapping to disk.
D.The disk is experiencing a high number of read/write operations, causing a bottleneck.
AnswerD

A %util of 100% indicates that the disk is fully utilized and cannot keep up with the I/O requests. This saturation leads to queuing and slow response times. The most likely cause is that the disk is the bottleneck due to excessive I/O demand, requiring investigation into which processes are generating the load.

Why this answer

A %util of 100% on a disk device means the disk is continuously busy servicing I/O requests, indicating a disk bottleneck. The most likely cause is that the disk cannot handle the current I/O load, whether from a specific process or overall system activity. Further investigation with tools like iotop can identify the culprit.

Exam trap

The trap here is misinterpreting %util as a CPU metric or attributing it to network issues, when it specifically measures disk utilization.

Practice this question →
84
MCQeasy

A server administrator is troubleshooting a Windows Server 2022 that cannot connect to a remote iSCSI target. The server has two network adapters: one for LAN traffic and one dedicated to iSCSI. The administrator verifies that the iSCSI adapter has a valid IP address, can ping the target, and that the iSCSI service is running. However, the iSCSI initiator shows the target as unavailable. Which action should the administrator take next?

A.Reinstall the iSCSI initiator driver on the server.
B.Check the Windows Firewall inbound rules for iSCSI traffic on the server.
C.Verify that the target's access control list includes the initiator's IQN.
D.Change the iSCSI adapter's IP address to be on the same subnet as the LAN adapter.
AnswerC

In iSCSI, the target often restricts access based on the initiator's IQN. If the IQN is not in the target's ACL, the target will be discovered but marked unavailable. Since IP connectivity and the service are confirmed, the next logical step is to verify that the initiator's IQN is authorized on the target. This is a common oversight when setting up iSCSI access.

Why this answer

The target is discovered but unavailable, while IP connectivity and the iSCSI service are confirmed. This points to an access control issue, such as the initiator IQN not being in the target's ACL. Verifying and adding the IQN to the target's allowed list is the correct next step.

Firewall, driver reinstallation, and IP changes are either less likely or inappropriate given the symptoms.

Exam trap

The trap here is assuming a network or driver problem when the target is reachable but access is denied by IQN-based ACLs.

Practice this question →
85
MCQmedium

A server administrator notices that a production file server intermittently loses network connectivity for a few seconds, and users report dropped SMB sessions. The switch port shows no errors, and the server's NIC link LED stays solid. The administrator suspects a duplex mismatch. Which tool should the administrator use to verify the NIC's current speed and duplex settings on a Linux server?

A.netstat -i
B.ethtool
C.ip addr show
D.tcpdump
AnswerB

ethtool queries and configures NIC driver and hardware settings, including reported speed, duplex, and link state. Running ethtool <interface> shows the negotiated duplex; if it reports half-duplex while the switch port is full-duplex, that confirms the mismatch causing intermittent drops without link loss. It is the standard Linux utility for this exact diagnostic scenario.

Why this answer

A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex, leading to collisions, dropped packets, and intermittent connectivity without a complete link loss. The NIC's link LED remains solid because the physical link is up. The ethtool utility directly reports the negotiated duplex and speed, allowing the administrator to confirm whether the server NIC is operating at half-duplex while the switch port is full-duplex.

Other tools show symptoms or unrelated configuration but not the duplex setting itself.

Exam trap

The trap here is assuming that a solid link LED and lack of switch port errors rule out a physical-layer duplex mismatch, when in fact a mismatch can cause intermittent performance issues without bringing the link down.

Practice this question →
86
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 system that reports a stop error (blue screen) with the code CRITICAL_PROCESS_DIED. The server reboots automatically and then works normally for a few hours before the error recurs. The administrator has already updated all drivers and installed the latest Windows updates. Which action should the administrator take next to gather more detailed diagnostic information about the crashes?

A.Run the System File Checker (sfc /scannow) to repair corrupted system files.
B.Configure the system to write a kernel memory dump and analyze it with Windows Debugging Tools.
C.Enable boot logging and restart the server in Safe Mode.
D.Use Performance Monitor to log memory and CPU usage over time.
AnswerB

A kernel memory dump captures the state of the kernel at the time of the crash, including the stack trace and loaded drivers. Analyzing it with WinDbg or the Windows Debugging Tools can reveal the specific driver or component that caused the CRITICAL_PROCESS_DIED stop error. Since basic updates did not resolve the issue, deeper analysis is the logical next step.

Why this answer

When a Windows server experiences recurring stop errors despite driver and OS updates, the administrator needs to capture and analyze a memory dump. The kernel memory dump contains the state of the kernel at the crash, including the call stack and loaded modules. Using Windows Debugging Tools (WinDbg) with the appropriate symbols allows the administrator to pinpoint the failing driver or process.

Other options either do not capture crash-time state or address different problem classes.

Exam trap

The trap here is assuming that updating drivers and OS patches resolves all stop errors, but CRITICAL_PROCESS_DIED often requires dump analysis to identify the specific third-party driver or process at fault.

Practice this question →
87
MCQeasy

A server administrator is troubleshooting a server that is unable to connect to the network. The administrator checks the NIC and sees that the link light is off. Which of the following is the FIRST thing the administrator should check?

A.The firewall rules on the server.
B.The IP address configuration on the server.
C.The DNS server settings on the server.
D.The network cable connection at both the server and the switch.
AnswerD

A missing link light typically indicates a physical layer issue. The most common cause is a disconnected or faulty cable. Checking both ends of the cable ensures it is securely plugged in and the switch port is active. This is a quick, non-intrusive step that often resolves the problem. If the cable is fine, then move to other possibilities.

Why this answer

When a NIC link light is off, the problem is at the physical layer. The first step is to verify the cable is properly connected to both the server and the switch, and that the switch port is enabled. This simple check resolves many connectivity issues.

Only after confirming physical connectivity should the administrator investigate IP, DNS, or firewall configurations.

Exam trap

The trap here is jumping to logical configuration like IP or DNS when the link light indicates a physical connection problem.

Practice this question →
88
MCQhard

A server administrator is troubleshooting a Windows Server 2019 host that runs a line-of-business application. Users report the application is extremely slow during business hours, but performance is normal at night. Performance Monitor shows high 'Avg. Disk sec/Read' on the data volume and a disk queue length consistently above 2. The volume is a single NTFS partition on a RAID 5 array of 7.2K RPM SATA drives. Which of the following is the MOST likely cause of the slow performance?

A.A network bottleneck is delaying storage I/O to the application.
B.The disk subsystem is experiencing an I/O bottleneck due to insufficient IOPS for the workload.
C.The RAID 5 array has a failed drive and is running in degraded mode.
D.The server's memory is insufficient and causing excessive paging to disk.
AnswerB

High 'Avg. Disk sec/Read' and a sustained queue length above 2 indicate the disks cannot keep up with demand. A RAID 5 array of 7.2K RPM SATA drives has limited random IOPS, and the write penalty of RAID 5 worsens under load. The slowdown only during business hours confirms the bottleneck appears when concurrent user activity peaks. Adding spindles, changing RAID level, or moving to SSD storage would address the root cause.

Why this answer

The performance counters show the disk subsystem is saturated: high read latency and a queue length above 2 mean requests are waiting. A RAID 5 array of 7.2K RPM SATA drives provides limited random IOPS, and the business-hours-only pattern matches peak user load. The correct remedy is to increase disk performance, such as adding spindles or moving to faster media.

Exam trap

The trap here is blaming a failed drive or memory pressure when the counters specifically isolate a storage throughput limit under peak load.

Practice this question →
89
Multi-Selecthard

A server administrator is troubleshooting a Windows Server 2019 that randomly reboots. The administrator suspects a hardware issue. Which two actions should the administrator take to gather evidence of the cause? (Choose two.)

Select 2 answers
A.Update the BIOS and all device drivers to the latest versions.
B.Enable and review the Windows Memory Diagnostic results.
C.Run the sfc /scannow command to check for system file corruption.
D.Configure a memory dump and analyze it with WinDbg.
E.Check the System event log for Event ID 41 (Kernel-Power).
AnswersD, E

Configuring a memory dump (e.g., kernel or complete) and analyzing it with WinDbg can reveal the exact cause of a crash, such as a bugcheck code and the driver or hardware involved. This is essential for diagnosing random reboots when event logs are inconclusive. It provides deep insight into the system state at the time of failure.

Why this answer

To diagnose random reboots, the administrator should first check the System event log for Event ID 41, which indicates an unclean shutdown and may include a bugcheck code. Additionally, configuring a memory dump and analyzing it with WinDbg provides detailed crash information, including the faulting driver or hardware component. These actions gather concrete evidence, unlike preventive measures or general system checks.

Exam trap

The trap here is choosing preventive or general maintenance actions like updating drivers or running sfc, which do not provide evidence of the cause of random reboots.

Practice this question →
90
MCQeasy

A server with dual redundant power supplies shuts down unexpectedly. One power supply has a solid amber LED. What is the most likely cause?

A.The server is drawing too much power
B.The power cord is unplugged
C.The power supply has failed
D.The server is overheating
AnswerC

A solid amber LED on a redundant PSU signals an internal fault, so the unit can no longer supply power. With one supply dead, the server loses redundancy and shuts down once the surviving supply cannot carry the full load, matching the unexpected shutdown described.

Why this answer

A solid amber LED on a power supply typically indicates a fault or failure of that power supply. Since the server shut down unexpectedly and one PSU shows amber, the most likely cause is that the power supply has failed, and the redundant PSU may not have been able to sustain the load alone or the failure caused a shutdown.

Exam trap

SK0-005 often tests hardware LED interpretation, so the trap is assuming a power issue like unplugged cord or overdraw rather than recognizing the amber LED as a PSU failure indicator.

How to eliminate wrong answers

Option A is wrong because excessive power draw would not typically cause a single PSU to show a solid amber LED; it might trigger overcurrent protection but usually affects both PSUs or causes different indicators. Option B is wrong because an unplugged power cord would result in no LED or a different indicator, not a solid amber fault LED. Option D is wrong because overheating would affect the server's thermal sensors and cause different alerts, not a specific PSU amber LED.

Practice this question →
91
MCQmedium

A server administrator is troubleshooting a Windows Server that is experiencing performance degradation. The administrator suspects a memory leak in a custom application. Which of the following tools should the administrator use to monitor the application's memory usage over time?

A.Resource Monitor's Memory tab.
B.Event Viewer's Application log.
C.Task Manager's Processes tab.
D.Performance Monitor with the Process\Private Bytes counter.
AnswerD

Performance Monitor allows the administrator to track specific counters over time. The Process\Private Bytes counter shows the amount of memory committed exclusively to a process, which is ideal for detecting a memory leak. By monitoring this counter for the custom application, the administrator can observe a steady increase that indicates a leak.

Why this answer

To diagnose a memory leak, the administrator needs to collect performance data over time. Performance Monitor with the Process\Private Bytes counter is designed for this purpose, allowing the creation of a data collector set that logs memory usage for the specific process. Analyzing the log will reveal a consistent upward trend, confirming the leak.

Exam trap

The trap here is choosing a real-time tool like Task Manager or Resource Monitor, which cannot show historical trends necessary to confirm a memory leak.

Practice this question →
92
MCQmedium

A server administrator is troubleshooting a RAID controller issue on a production server. The server has a hardware RAID 5 array with three drives. The administrator notices that one drive's status LED is solid amber, and the RAID controller management utility reports the array as degraded. The administrator has a replacement drive of the same model and capacity. Which action should the administrator take to restore the array to optimal status?

A.Hot-swap the failed drive with the replacement and allow the controller to automatically rebuild the array.
B.Shut down the server, replace the drive, and then recreate the RAID array from scratch.
C.Replace all three drives simultaneously to ensure compatibility and rebuild the array.
D.Run a consistency check on the array and mark the failed drive as online.
AnswerA

In a hardware RAID 5 array with a failed drive, the correct procedure is to replace the failed drive while the system is running, if the controller and backplane support hot-swapping. The controller will detect the new drive and begin rebuilding the array using parity data. This restores redundancy with minimal downtime and is the standard practice for degraded RAID arrays.

Why this answer

A degraded RAID 5 array with a failed drive should be restored by replacing the failed drive and allowing the controller to rebuild. Hot-swapping is supported on most server backplanes and minimizes downtime. Recreating the array or replacing all drives destroys data, and forcing a failed drive online does not address the hardware failure.

The correct action is to replace the single failed drive and rebuild.

Exam trap

The trap here is thinking that a degraded array requires recreating the RAID set, when a rebuild from parity is the proper recovery method.

Practice this question →
93
MCQeasy

A server administrator is troubleshooting a server that fails to power on. The administrator presses the power button, but nothing happens: no fans, no lights, no beep codes. The server is connected to a known-good power outlet. Which of the following should the administrator check FIRST?

A.The front panel power button cable connection.
B.The RAM modules for proper seating.
C.The power supply unit (PSU) LEDs and connections.
D.The CMOS battery voltage.
AnswerC

When a server shows no signs of power, the power supply is a primary suspect. Checking the PSU LEDs (if present) and ensuring the power cables are securely connected to both the PSU and the motherboard is a logical first step. Many servers have status LEDs on the PSU that indicate power good; if unlit, the PSU may be faulty or not receiving power.

Why this answer

The absence of any power indicators (fans, lights, beeps) strongly suggests a power delivery problem. The administrator should first verify that the PSU is receiving power and functioning, by checking its LEDs and ensuring all power connections are secure. This is the most direct and common cause of a completely dead server.

Exam trap

The trap here is overthinking and checking internal components like RAM or CMOS battery before verifying the most basic power delivery path.

Practice this question →
94
MCQhard

A web application server is experiencing intermittent 502 Bad Gateway errors during peak usage hours. The server's reverse proxy logs show connections to the backend application server being refused. The application server's resource monitor shows CPU utilization at 95% and memory utilization at 40%. Which of the following actions is MOST likely to resolve the issue?

A.Replace the reverse proxy with a hardware load balancer.
B.Add more CPU cores to the server.
C.Increase the server's physical memory.
D.Adjust thread pool and connection timeout settings on the application server.
AnswerD

CPU saturation at 95% with ample memory points to thread pool exhaustion: the reverse proxy's connections are refused because no worker threads are free. Tuning thread pool size and connection timeouts lets the application accept and hold more concurrent connections, resolving the 502 errors.

Why this answer

The 502 errors with connection refusals and 95% CPU (but only 40% memory) point to application-layer thread/connection exhaustion rather than raw hardware shortage. Tuning the thread pool and connection timeout settings allows the application server to handle more concurrent connections and recycle stuck ones, directly addressing the bottleneck.

Exam trap

SK0-005 often tests whether candidates jump to hardware upgrades (CPU, RAM) when the metrics and error pattern clearly indicate a software configuration bottleneck, so resource-utilization numbers are included to mislead hardware-first thinkers.

How to eliminate wrong answers

Option A is wrong because replacing the reverse proxy does not fix backend connection refusals caused by application thread exhaustion — the proxy is functioning correctly by reporting 502s. Option B is wrong because adding CPU cores may help marginally but does not address the root cause of thread pool saturation and refused connections; it is a costly hardware fix for a configuration problem. Option C is wrong because memory utilization is only 40%, so adding RAM provides no benefit to a CPU/thread-bound issue.

Practice this question →
95
MCQmedium

A server administrator is troubleshooting a production server that boots successfully but intermittently reboots without warning. The IPMI event log shows no thermal or power events, and the OS logs show nothing before each reset. The administrator suspects a hardware fault and wants to capture the most detailed low-level diagnostic information the next time the server hangs or resets. Which of the following should the administrator configure to BEST collect this data?

A.Enable the baseboard management controller's System Event Log (SEL) with a higher severity threshold
B.Enable the BMC's integrated management log and configure chassis intrusion detection alerts
C.Enable the platform's crash dump or NMI-on-hang feature so hardware state is saved on the next fault
D.Configure a memory dump of the operating system kernel to be written to a dedicated dump partition
AnswerC

A platform crash dump triggered by an NMI or hang detection captures processor, memory controller, and firmware state at the instant of failure, which is exactly the low-level data missing from the SEL and OS logs. This is the correct tool when resets occur with no OS or SEL trace, because it records state before the platform restarts and overwrites volatile information.

Why this answer

When a server resets with no SEL, thermal, power, or OS log evidence, the fault is likely below the OS, so capturing platform-level state at the moment of failure is the only way to obtain actionable data. A hardware crash dump or NMI-triggered dump preserves CPU, memory, and firmware context that would otherwise be lost on reboot, making it the correct configuration for this scenario.

Exam trap

The trap here is assuming that the baseboard management controller's event log always captures the cause of an unexpected reset, when it only records platform events such as power and thermal conditions.

Practice this question →
96
MCQmedium

A server administrator is troubleshooting a server that is unable to boot from its local RAID 1 array. The server POSTs successfully, but after the RAID controller initialization, the message 'No boot device found' is displayed. The administrator verifies that both drives in the array are online and the RAID controller reports the array as optimal. Which of the following is the MOST likely cause?

A.The boot order in the system BIOS/UEFI is incorrect.
B.The RAID controller firmware is outdated and needs to be updated.
C.The bootloader on the RAID volume is corrupted.
D.The RAID array is degraded, but the controller has not yet reported it.
AnswerA

Even if the RAID array is healthy, the system firmware must be configured to boot from the RAID controller. If the boot order lists other devices (e.g., network, CD-ROM) before the RAID volume, or if the RAID controller is disabled in boot options, the system will not find the bootloader. This is a common oversight after hardware changes or firmware updates.

Why this answer

The system firmware must be set to boot from the RAID controller. If the boot order is incorrect, the server will not find the bootable volume even though the array is healthy. The correct answer addresses this configuration issue.

Exam trap

The trap here is assuming a hardware failure when the error message points to a configuration issue; always check boot order after hardware or firmware changes.

Practice this question →
97
MCQhard

A Linux administrator is troubleshooting a production web server that randomly stops accepting connections. The system log shows 'kernel: TCP: request_sock_TCP: Possible SYN flooding on port 443' followed by dropped connections. The server is behind a load balancer and legitimate traffic is high but expected. The administrator suspects the SYN backlog is too small for the current connection rate. Which of the following should the administrator adjust to increase the number of half-open connections the kernel will queue?

A.Disable SYN cookies by setting net.ipv4.tcp_syncookies to 0.
B.Increase net.ipv4.ip_local_port_range to allow more ephemeral connections.
C.Increase the value of net.core.somaxconn and reload the kernel module.
D.Increase the value of net.ipv4.tcp_max_syn_backlog in /etc/sysctl.conf and apply it with sysctl -p.
AnswerD

The net.ipv4.tcp_max_syn_backlog parameter controls how many half-open connection requests the kernel queues before SYN cookies activate. Raising it accommodates the expected high connection rate from the load balancer and directly addresses the SYN flooding warning observed in the kernel log.

Why this answer

The SYN flooding warning appears when the half-open connection queue fills faster than handshakes complete. The net.ipv4.tcp_max_syn_backlog setting defines that queue's depth, so raising it lets the server hold more pending handshakes under the legitimate load generated by the load balancer.

Exam trap

The trap here is confusing the established-connection backlog (somaxconn) with the half-open SYN backlog (tcp_max_syn_backlog), which are distinct kernel queues.

Practice this question →
98
MCQmedium

A server administrator is troubleshooting a server that is randomly rebooting. The administrator reviews the system logs and finds event ID 41 (Kernel-Power) in the Windows System log. Which of the following is the MOST likely cause?

A.A software application crash
B.A failing power supply unit
C.A faulty memory module
D.An overheating CPU
AnswerB

Event ID 41 (Kernel-Power) is logged when the system reboots without first shutting down cleanly, often due to a power loss or hardware failure. A failing PSU can cause intermittent power loss, leading to unexpected reboots. This is a common cause, especially if the server is not on a UPS or the PSU is degraded.

Why this answer

Event ID 41 (Kernel-Power) indicates that the system rebooted without cleanly shutting down, which is often caused by a power interruption or hardware failure. A failing power supply unit is a common culprit, as it can cause intermittent power loss leading to unexpected reboots. While overheating or memory issues could cause crashes, they would typically generate additional specific error events.

Therefore, the PSU is the most likely cause.

Exam trap

The trap here is attributing the reboot to software or memory without considering that Event ID 41 specifically points to an unexpected shutdown, often power-related.

Practice this question →
99
MCQhard

A Linux server administrator notices that a production server's root filesystem is 100% full. The server is still running but new log entries are failing to write. The administrator runs `df -h` and sees /dev/sda3 at 100% usage, but `du -sh /` reports only 45 GB used on a 100 GB filesystem. Which command should the administrator use to identify the large deleted file that is still held open by a process?

A.lsof +L1
B.iostat -x 1
C.find / -type f -size +1G -exec ls -lh {} \;
D.fdisk -l /dev/sda
AnswerA

lsof +L1 lists open files with a link count less than one, which identifies deleted files still held open by running processes. In this scenario, the space discrepancy between df and du strongly suggests a deleted file that a process has not released. This command will show the process ID and file size, allowing the administrator to restart the process and reclaim space.

Why this answer

The difference between df (100 GB used) and du (45 GB used) indicates that space is allocated to a file no longer visible in the directory tree, typically a deleted file still open by a process. lsof +L1 lists such files, showing the PID and size. Restarting the process releases the handle and frees the space. Other commands either show disk layout, existing files, or I/O performance, none of which identify the hidden space consumer.

Exam trap

The trap here is relying on du or find to locate the space, when the file is unlinked and only visible through open file descriptors.

Practice this question →
100
MCQeasy

A datacenter technician is troubleshooting a rack-mounted server whose front-panel health LED is solid amber and whose management interface reports a fan failure in bay 3. The server is still running production workloads. Which of the following should the technician do FIRST?

A.Schedule an immediate graceful shutdown of the server to replace the fan.
B.Verify whether the failed fan is redundant and monitor the server's thermal sensors and remaining fan speeds.
C.Disable the fan failure alert in the management interface to stop the amber LED.
D.Replace the fan immediately by pulling it from the chassis while the server continues running.
AnswerB

Most enterprise servers use redundant hot-swap fans, so a single failure may not threaten operation if temperatures remain within thresholds. Checking the management controller for redundancy status and thermal readings confirms whether the server is safe to keep running while a replacement is sourced. This is the least disruptive and most informative first step before any physical intervention.

Why this answer

When a single fan fails on a server with redundant cooling and the system is still running production workloads, the priority is to confirm that redundancy and thermal margins are intact before touching hardware. Reading the management controller's fan and temperature sensors establishes whether the server is safe to continue operating, allowing a hot-swap replacement to be scheduled without an outage.

Exam trap

The trap here is treating any amber health LED as an emergency requiring immediate shutdown, when a single redundant fan failure is typically a non-disruptive hot-swap event.

Practice this question →
101
MCQmedium

A server configured with a RAID 5 array and a hot spare experiences intermittent crashes under heavy disk I/O. A technician suspects a failing drive. Which of the following should the technician do FIRST?

A.Initiate a manual failover to the hot spare.
B.Remove the suspected drive and rebuild the array.
C.Replace the hot spare with a new drive.
D.Run the array manufacturer's diagnostic utility.
AnswerD

Diagnostics read the array's SMART data and controller logs, confirming which drive is failing without disturbing the hot spare rebuild. This non-destructive step identifies the faulty member before any physical replacement, satisfying the requirement to act first.

Why this answer

Running the array manufacturer's diagnostic utility is the least invasive first step—it can identify which drive is failing and confirm the suspected fault without disrupting the array or risking unnecessary rebuilds. This aligns with standard troubleshooting methodology: diagnose before replacing or rebuilding. Only after confirmation should the technician take corrective action.

Exam trap

SK0-005 often tests whether candidates skip diagnosis and jump straight to disruptive remediation (failover, rebuild, replacement) instead of running diagnostics first to confirm the fault.

How to eliminate wrong answers

Option A is wrong because initiating a manual failover to the hot spare is a disruptive action that should only be taken after confirming the drive is actually failing; doing it prematurely can cause unnecessary rebuilds and risk. Option B is wrong because removing the suspected drive and rebuilding the array is invasive and could cause data loss or extended downtime if the wrong drive is removed. Option C is wrong because replacing the hot spare does not address the suspected failing drive and wastes a known-good spare.

Practice this question →
102
MCQhard

A server administrator is troubleshooting a Windows Server that is experiencing intermittent network disconnections. The server has a single NIC connected to a switch. Users report that access to file shares drops for about 30 seconds several times a day. The administrator reviews the switch logs and sees no port flapping. Which Windows tool should the administrator use to determine if the NIC is repeatedly resetting or if a driver is causing the disconnections?

A.Performance Monitor with the Network Interface counter set.
B.Event Viewer, specifically the System log for network adapter events.
C.Resource Monitor, Network tab.
D.Device Manager, viewing the NIC's properties and driver details.
AnswerB

The System log in Event Viewer records events from the network adapter driver, including link state changes, resets, and errors. If the NIC is resetting, events with source 'e1i' or similar will appear. This directly addresses the intermittent disconnections and can correlate with the times users report outages. It is the most direct way to see if the adapter itself is the cause.

Why this answer

Intermittent network disconnections on a Windows server can be caused by NIC driver resets or hardware faults. The System event log in Event Viewer captures driver-level events, including link down/up, resets, and error codes. By filtering for the network adapter source, the administrator can see if the NIC is repeatedly resetting and correlate the timestamps with user reports.

Other tools provide live metrics or configuration details but lack the historical event logging needed to diagnose intermittent hardware or driver behavior.

Exam trap

The trap here is focusing on live performance counters or device configuration when the problem is intermittent; only historical event logs can reveal repeated NIC resets that occur between user reports.

Practice this question →
103
MCQmedium

Users report slow file server performance. The administrator suspects a single process is consuming excessive CPU and wants to analyse its threads and handles. Which tool should be used?

A.System Information
B.Task Manager
C.Resource Monitor
D.Performance Monitor
AnswerC

Resource Monitor offers detailed real-time metrics per process, including thread and handle counts, allowing precise identification of resource consumption.

Why this answer

Resource Monitor (resmon.exe) in Windows provides detailed per-process analysis including CPU usage, thread-level details, and handle counts, making it the right tool to inspect a specific process's threads and handles. It offers a granular view that Task Manager lacks, such as the ability to see which threads are consuming CPU and what handles a process has open. This directly addresses the administrator's need.

Exam trap

SK0-005 often tests the functional boundaries between Windows diagnostic tools, and candidates confuse Task Manager's process-level view with Resource Monitor's thread- and handle-level detail, or pick Performance Monitor for real-time interactive inspection.

How to eliminate wrong answers

Option A is wrong because System Information (msinfo32.exe) provides a static inventory of hardware, drivers, and system configuration — it does not offer real-time per-process thread or handle analysis. Option B is wrong because Task Manager shows overall process CPU and memory usage but does not break down threads or handles for a specific process; it is too high-level for this diagnostic need. Option D is wrong because Performance Monitor (perfmon.msc) is used for creating performance counters and logs over time, but it does not provide the interactive per-process thread and handle inspection that Resource Monitor does.

Practice this question →
104
Multi-Selectmedium

A server experienced an unexpected power loss. After power is restored, the server boots successfully, but several critical services fail to start automatically. The administrator checks the system logs and finds errors indicating missing LUNs from a SAN. The SAN administrator confirms the SAN is online and the LUNs are assigned to the server's WWNs. The server uses FC HBAs. Which TWO steps should the administrator perform to diagnose the issue?

Select 2 answers
A.Rescan the SCSI bus on the server.
B.Check the FC switch zoning configuration.
C.Replace the FC HBAs.
D.Reboot the SAN controller.
E.Reinstall the multipathing driver.
AnswersA, B

After an unexpected power loss, the HBA may not have re-established its target discovery. Rescanning the SCSI bus forces the host to rediscover LUNs presented by the SAN, resolving the missing-LUN errors reported in the system logs.

Why this answer

Option A is correct because after an unexpected power loss the host may have stale or missing SCSI device entries; rescanning the SCSI bus (e.g., echo "- - -" > /sys/class/scsi_host/hostX/scan or rescan-scsi-bus.sh) forces the HBA driver to re-discover LUNs presented by the SAN, which directly addresses the missing-LUN errors. Option B is correct because even when the SAN administrator confirms LUNs are assigned to the server's WWNs, incorrect or missing FC switch zoning (or an inactive zone set) prevents the host from seeing those LUNs, so verifying the zone membership and that the zone set is enabled is a key diagnostic step. Option C is not appropriate because replacing HBAs is a hardware remedy with no evidence of HBA failure, and the SAN already recognizes the server's WWNs.

Option D is not appropriate because the SAN is confirmed online and rebooting a SAN controller is disruptive and unjustified. Option E is not appropriate because reinstalling the multipathing driver is a software repair step that should only follow confirmation that the driver is actually faulty, not a first-line diagnostic for missing LUNs.

Exam trap

SK0-005 often tests whether candidates jump to hardware replacement or disruptive SAN actions instead of first performing non-disruptive diagnostics like a SCSI rescan and zoning verification when LUNs disappear after a power event.

Practice this question →
105
MCQeasy

Users report that a file server responds to ping by IP address but fails when they browse to it by hostname. The server's IP address has not changed, and other servers on the same subnet resolve correctly. Which of the following should the administrator check FIRST?

A.The DNS record for the file server on the authoritative DNS server
B.The Windows Firewall profile on the file server
C.The duplex and speed settings on the server's network adapter
D.The default gateway configured on the file server
AnswerA

Successful ping by IP but failure by hostname points squarely at name resolution. If the server's address changed or the record was deleted, clients would time out on the hostname while still reaching the IP. Checking the authoritative DNS record confirms whether the A or CNAME entry exists and matches the current address.

Why this answer

When a host answers by IP but not by name, resolution is the failing layer. Other servers resolving correctly rules out a client-side DNS outage, so the record for this specific server is the prime suspect. Checking the authoritative zone confirms whether the entry is missing, stale, or pointing at an old address.

Exam trap

The trap here is chasing the server's network configuration, such as gateway or adapter settings, when the IP path already works and the failure is purely name translation.

Practice this question →
106
Multi-Selecthard

A server administrator is investigating a Linux file server that periodically becomes unresponsive for several minutes. During an outage, the administrator runs top and iostat and observes that %iowait is extremely high while CPU utilization remains low. Disk latency on the data volume spikes to several seconds. The storage is a hardware RAID 10 array with healthy member disks, and no rebuild or patrol read is active. Which of the following are the MOST likely causes of the observed latency? (Choose two.)

Select 2 answers
A.The server's memory is running in single-channel mode instead of dual-channel mode
B.The network interface has negotiated a lower speed, causing the file server's clients to time out
C.The RAID controller's write-back cache has been disabled or switched to write-through mode
D.The array is rebuilding after a member disk replacement, consuming all available controller bandwidth
E.A backup or antivirus scan is issuing a large volume of small random reads and writes to the data volume
AnswersC, E

Without write-back caching, every write must be committed to the physical media before the operation completes, so bursts of small writes produce multi-second latency and high %iowait even on healthy RAID 10 members. This directly matches the symptom pattern of low CPU with extreme disk wait, and it is a common cause after battery or capacitor failures force the controller into write-through mode.

Why this answer

High %iowait with low CPU utilization and multi-second latency on a healthy RAID 10 array points to storage-side saturation. Disabling write-back caching forces synchronous writes to media, and heavy small-block random I/O from a backup or antivirus sweep can exhaust the array's IOPS, both producing the episodic stalls described. Eliminating rebuild activity and memory or network causes leaves these two as the most likely culprits.

Exam trap

The trap here is blaming the network or memory for slow file access when the measured server-side counters clearly localize the wait to the storage subsystem.

Practice this question →
107
MCQhard

A storage administrator is troubleshooting a SAN-attached server that intermittently loses access to its LUNs. The Windows Server event log shows repeated 'Disk' warning events with the message that a device has been surprise-removed, and the host bus adapter logs report link resets. The SAN fabric switches show no errors, and the array reports all ports healthy. Which of the following is the MOST likely cause?

A.The LUN is configured with the wrong RAID level on the array.
B.The SAN array has a failing controller that is dropping frames on the fabric.
C.The multipath I/O software is misconfigured, causing path thrashing between the two HBAs.
D.The zoning configuration on the fabric switches is missing the second HBA's WWPN.
AnswerC

Surprise-removal events combined with HBA link resets and a clean fabric point to the host repeatedly switching active paths. Incorrect MPIO policy or missing vendor DSM settings can cause the host to flap between paths, dropping the device each time, which matches the intermittent loss of LUN access.

Why this answer

Intermittent surprise-removal events with HBA link resets on a fabric and array that both report healthy are classic symptoms of path instability at the host. A misconfigured or unsupported MPIO policy causes the host to repeatedly fail over between adapters, dropping the LUN each time it switches.

Exam trap

The trap here is blaming the fabric or array because the symptom is storage-related, when the evidence points to host-side multipath behavior.

Practice this question →
108
MCQmedium

A server administrator is troubleshooting a server that unexpectedly rebooted overnight. The administrator reviews the system logs and finds Event ID 6008 in the Windows System log, indicating an unexpected shutdown. There are no corresponding events for a thermal trip or power failure. Which of the following should the administrator check FIRST to determine the cause?

A.Review the Windows Update history to see if a patch was installed that required a reboot.
B.Check the server's out-of-band management controller logs for power or hardware events.
C.Run a memory diagnostic to check for faulty RAM.
D.Verify that the UPS is functioning correctly and has enough battery capacity.
AnswerB

Because the operating system was not running cleanly when the server went down, its own logs may say nothing about the cause. The out-of-band management controller, such as iDRAC, iLO, XClarity or another BMC, runs independently of the OS and records power supply failures, voltage and temperature events, memory errors and watchdog resets. Checking its log is quick and often explains the reboot immediately.

Why this answer

Event ID 6008 indicates an unexpected shutdown, which often stems from hardware or power issues. The out-of-band management controller logs are the best source for hardware-level events like power supply failures or thermal trips that are not visible to the OS. Reviewing these logs first can quickly identify or rule out hardware causes before moving to OS-level diagnostics.

Exam trap

The trap here is assuming that an unexpected shutdown is always software-related and diving into OS logs, when hardware logs often hold the answer.

Practice this question →
109
MCQhard

A server administrator is investigating intermittent network disconnects on a production server. The server is connected to a Cisco switch with a single Cat 6a cable. The administrator runs a cable tester and finds that the cable passes all tests. However, users report that connectivity drops for a few seconds multiple times per day. The switch logs show that the port flaps (goes up and down) during these times. Which of the following is the MOST likely cause?

A.The network cable is experiencing electromagnetic interference (EMI) from nearby power cables.
B.The switch port is configured with an incorrect speed or duplex setting, causing a mismatch.
C.The NIC firmware is outdated and causing the link to reset under load.
D.The NIC is configured to allow the operating system to turn off the device to save power.
AnswerD

Power management settings on the NIC can cause the adapter to enter a low-power state, leading to link drops that appear as flapping on the switch. This is a common cause of intermittent disconnects, especially when the server is idle. Disabling power-saving features on the NIC typically resolves the issue.

Why this answer

Intermittent link flapping with a known-good cable often points to NIC power management. When the operating system is allowed to turn off the NIC to save power, the link can drop and re-establish, causing the switch port to flap. Disabling this setting in the NIC's power management properties prevents the adapter from powering down and stabilizes connectivity.

Exam trap

The trap here is focusing on physical layer issues like cables or switch configuration when the cause is a software-controlled power-saving feature on the NIC.

Practice this question →
110
Multi-Selecthard

A server administrator is troubleshooting a server that has been experiencing random reboots and unexpected shutdowns. The administrator has checked the system logs and found multiple 'Machine Check Exception' (MCE) events and 'Corrected Memory Error' warnings. The server is running mission-critical applications and cannot be taken offline for extended periods. Which of the following should the administrator perform to diagnose and resolve the issue? (Choose two.)

Select 2 answers
A.Disable error correction in the BIOS to prevent further errors.
B.Reinstall the operating system to eliminate software-related memory errors.
C.Replace the power supply unit with a higher-wattage model.
D.Update the server's BIOS and firmware to the latest versions.
E.Run a comprehensive memory diagnostic test using a tool such as Memtest86+.
AnswersD, E

BIOS and firmware updates often include microcode patches that address known memory compatibility issues and error handling. Outdated firmware can cause incorrect memory error reporting or even contribute to MCEs. Updating to the latest versions is a recommended step for resolving such errors and ensuring system stability.

Why this answer

Corrected memory errors and MCEs often stem from faulty RAM or outdated firmware. Running a memory diagnostic test identifies bad modules, while updating BIOS/firmware can resolve known errata and improve memory handling. These two actions directly address the root causes without unnecessary hardware changes or system reinstalls.

Exam trap

The trap here is focusing on power or software solutions when the error messages explicitly point to memory and firmware issues.

Practice this question →
111
MCQeasy

A server fails to complete POST and emits a series of beeps: two long, three short. According to the manufacturer's documentation, this beep code indicates a memory error. The server has eight DIMMs installed. Which of the following steps should the technician perform FIRST?

A.Replace all memory modules.
B.Reseat all memory modules and attempt to boot.
C.Clear the CMOS battery.
D.Update the server's UEFI firmware.
AnswerB

Reseating memory modules is the least invasive first step, addressing intermittent contact faults that commonly trigger memory beep codes. It avoids unnecessary part replacement before confirming whether reseating resolves the POST failure across the eight installed DIMMs.

Why this answer

When a POST beep code indicates a memory error, the least invasive and most logical first step is to reseat all memory modules and retry the boot. Memory modules can become unseated due to thermal cycling, vibration, or incomplete installation, and reseating is a non-destructive action that may resolve the error without replacing hardware. Only if reseating fails should the technician proceed to more involved diagnostics such as testing individual DIMMs or replacing modules.

Exam trap

SK0-005 often tests the principle of 'least invasive first' — candidates are tempted to jump to hardware replacement or firmware updates when the correct answer is the simplest physical remediation step.

How to eliminate wrong answers

Option A is wrong because replacing all memory modules is a costly, time-consuming action that should only be taken after reseating and individual DIMM testing have failed to resolve the issue. Option C is wrong because clearing the CMOS battery resets BIOS/UEFI settings and is unrelated to a memory POST beep code; it would not address a physical memory fault. Option D is wrong because updating UEFI firmware is a maintenance action that does not resolve a hardware-level memory error indicated by POST beeps and could introduce additional risk if performed unnecessarily.

Practice this question →
112
MCQmedium

A server's performance degrades significantly during peak usage hours. Monitoring shows high memory utilization and consistently high disk I/O. Which of the following should the technician check FIRST?

A.RAID controller battery status
B.Network bandwidth utilization
C.CPU utilization statistics
D.Page file location and configuration
AnswerD

High memory utilisation with sustained disk I/O points to paging, where Windows offloads memory pages to disk. Checking the page file's location and size reveals whether it sits on a slow or contended volume, and whether it is too small, forcing excessive paging. This directly addresses the memory and disk pressure seen at peak hours.

Why this answer

High memory utilization combined with consistently high disk I/O strongly suggests the system is paging — moving memory contents to and from disk because physical RAM is exhausted. The page file's location and configuration directly affect paging performance, so checking it first is the most targeted diagnostic step. If the page file is on a slow disk, is too small, or is fragmented across volumes, it can cause severe I/O bottlenecks during peak usage.

Exam trap

SK0-005 often tests whether candidates recognize the memory-disk I/O correlation as a paging symptom rather than chasing unrelated subsystems like CPU or network, which are common distractors in performance questions.

How to eliminate wrong answers

Option A is wrong because RAID controller battery status affects write-back caching behavior, but it would not typically produce the combination of high memory utilization and high disk I/O seen here. Option B is wrong because network bandwidth utilization would not cause high local disk I/O and memory pressure on the server itself. Option C is wrong because CPU utilization statistics, while useful, do not explain the correlation between memory exhaustion and disk I/O that points directly to paging activity.

Practice this question →
113
MCQhard

Refer to the exhibit. A Linux server started reporting I/O errors to its local disk. The administrator runs `dmesg` and sees the output shown. Which of the following is the MOST likely cause of the errors?

A.The disk has a bad sector that cannot be remapped.
B.The filesystem on /dev/sda is corrupted.
C.The SCSI cable is loose.
D.The RAID controller firmware is outdated.
AnswerA

dmesg I/O errors referencing unrecoverable read failures on a specific sector indicate the drive cannot remap that sector to a spare, so reads fail persistently. This matches a bad sector that cannot be remapped, distinguishing it from cabling or controller faults.

Why this answer

I/O errors reported by dmesg that reference specific sectors on a local disk typically indicate a bad sector that the drive's firmware cannot remap to a spare sector. When the disk's spare sector pool is exhausted or the error is unrecoverable, the kernel logs I/O errors against the affected block device. This is the most likely cause when the errors are isolated to a single disk and no other systemic issues are present.

Exam trap

SK0-005 often tests whether candidates can distinguish between disk-level hardware errors (bad sectors) and filesystem-level corruption, since both produce I/O-related messages but require very different remediation.

How to eliminate wrong answers

Option B is wrong because filesystem corruption would typically produce different error messages (e.g., ext4 errors, journal aborts) rather than raw I/O errors tied to specific disk sectors. Option C is wrong because a loose SCSI cable would usually cause the entire device to drop offline or produce widespread, intermittent errors across all disks on that bus, not isolated sector-level I/O errors. Option D is wrong because outdated RAID controller firmware would affect the entire array's behavior and would not typically manifest as isolated bad-sector I/O errors on a single disk.

Practice this question →
114
Multi-Selectmedium

A server administrator is troubleshooting a server that intermittently loses network connectivity. The administrator suspects a hardware issue. Which two components should the administrator check first? (Choose two.)

Select 2 answers
A.Network cable
B.CPU
C.Hard drive
D.Power supply unit (PSU)
E.Network interface card (NIC)
AnswersA, E

A damaged or loose network cable can cause intermittent connectivity. Checking the cable involves reseating, swapping with a known-good cable, and testing. This is a quick and logical first step because cables are a common point of failure. If the cable is faulty, replacing it resolves the issue.

Why this answer

The correct answers are the NIC and the network cable. Intermittent network connectivity often stems from these components. Checking the NIC involves driver updates and event log review, while the cable should be reseated or replaced.

These steps are quick, non-disruptive, and address the most probable causes.

Exam trap

The trap here is overcomplicating the diagnosis by considering system-wide components like the PSU or CPU, when the symptom is isolated to network connectivity.

Practice this question →
115
Multi-Selecthard

A server administrator is troubleshooting a Linux web server that has become unresponsive to SSH and HTTP requests. The administrator connects through the out-of-band management console and finds the system load average extremely high, with a large number of processes in the D state. The administrator suspects an I/O bottleneck. Which of the following commands should the administrator use to identify the processes and devices contributing to the bottleneck? (Choose two.)

Select 2 answers
A.systemctl status httpd
B.free -m
C.iotop -o
D.netstat -tulpn
E.iostat -x 2
AnswersC, E

iotop displays per-process I/O usage in real time, and the -o option shows only processes actively performing I/O. This lets the administrator map the D-state processes to specific I/O activity and identify the offending workloads. It complements device-level statistics by showing which processes generate the load.

Why this answer

To diagnose an I/O bottleneck, the administrator needs both device-level and process-level visibility. iostat -x with an interval shows per-device utilization and queue metrics, while iotop -o shows which processes are actively performing I/O. Together they identify the saturated device and the workloads causing it. Memory, network, and service-status tools do not provide this combined view.

Exam trap

The trap here is reaching for familiar general-purpose tools like free or netstat instead of the specialized I/O monitoring utilities that expose per-device and per-process disk activity.

Practice this question →
116
MCQhard

A server administrator is troubleshooting a Linux server that runs a critical database. Users report that queries have become extremely slow, but the server still responds to pings and SSH sessions. Running top and iostat shows the CPU is mostly idle while disk utilization is pinned near 100 percent with high await times on the data volume. Which of the following is the MOST likely cause?

A.A scheduled backup job is consuming all available network bandwidth.
B.The storage subsystem is experiencing an I/O bottleneck, such as a failing disk or saturated array.
C.The server's NIC is negotiating at 100Mb half-duplex instead of 1Gb full-duplex.
D.The server has insufficient RAM and is swapping heavily to the swap partition.
AnswerB

High disk utilization with elevated await and low CPU usage is the classic signature of an I/O-bound storage layer. A degraded disk, saturated array, or failing drive forces requests to queue, which slows the database queries that depend on those reads and writes. Investigating the RAID status, SMART data, and per-device iostat metrics would confirm which physical device is responsible.

Why this answer

When CPU is idle but the data volume shows near-total utilization and high await, the storage layer is the constraint. Database performance then hinges on how quickly the array and disks service reads and writes. Confirming the cause means checking RAID health, SMART attributes, and per-device latency rather than network or memory metrics, which the evidence does not implicate.

Exam trap

The trap here is latching onto the most familiar performance culprit, such as network or RAM, instead of matching the specific metric pattern of idle CPU with saturated disk await.

Practice this question →
117
MCQeasy

A server administrator is troubleshooting a server that intermittently loses network connectivity. The server is connected to a switch port that is configured for 802.1X authentication. The administrator checks the switch logs and sees repeated authentication failures for the server's MAC address. The server's operating system logs show no network errors. Which of the following is the MOST likely cause of the connectivity loss?

A.The server's NIC driver is outdated and causing intermittent link drops.
B.The switch port is configured for half-duplex, causing collisions.
C.The switch port is configured for the wrong VLAN.
D.The server's 802.1X supplicant credentials are incorrect or expired.
AnswerD

The switch logs show repeated authentication failures for the server's MAC address, which directly indicates that the 802.1X authentication process is failing. This is most commonly due to incorrect, expired, or misconfigured credentials on the supplicant (the server). When authentication fails, the switch port may be placed in a restricted VLAN or shut down, causing intermittent connectivity if the server occasionally authenticates successfully or if the port is reset. Checking and updating the supplicant credentials should resolve the issue.

Why this answer

The switch logs showing repeated 802.1X authentication failures for the server's MAC address indicate that the server is not successfully authenticating. This is typically due to incorrect or expired credentials on the supplicant. When authentication fails, the switch may place the port in a guest VLAN or block traffic, leading to intermittent connectivity if the server occasionally succeeds or if the port is reset.

Verifying and correcting the supplicant configuration is the appropriate fix.

Exam trap

The trap here is focusing on the server's OS logs showing no errors and assuming the problem is hardware, when the switch logs clearly point to an authentication failure.

Practice this question →
118
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 file server that occasionally becomes unresponsive for several minutes. Users report that during these times, they cannot access shared folders. The administrator checks Task Manager and sees that disk queue length is consistently high, and the disk active time is near 100%. Which of the following is the MOST likely cause?

A.The server has insufficient RAM, causing excessive paging.
B.The server's CPU is overheating and throttling performance.
C.The network adapter is faulty, causing dropped packets.
D.A disk-intensive application or process is causing an I/O bottleneck.
AnswerD

High disk queue length and near 100% disk active time indicate that the disk subsystem is overwhelmed with requests. This is classic evidence of an I/O bottleneck, often caused by a process performing heavy read/write operations, such as a backup job, antivirus scan, or a misbehaving application. The unresponsiveness occurs because the disk cannot service requests fast enough.

Why this answer

The high disk queue length and near 100% disk active time are key indicators of an I/O bottleneck. When the disk subsystem is saturated with requests, the server becomes unresponsive to file share requests. The most likely cause is a process or application performing excessive disk operations, which can be identified using Resource Monitor or Performance Monitor, and then addressed by rescheduling or terminating the process.

Exam trap

The trap here is focusing on the symptom of users not accessing shares and assuming a network problem, while ignoring the disk performance counters that clearly indicate a storage bottleneck.

Practice this question →
119
PBQhard

A company has a small virtualized environment with two ESXi 7.0 hosts (HostA and HostB) managed by vCenter Server. They use a shared iSCSI storage array for all VMs. The network consists of a single physical switch that connects the hosts, storage, and management traffic using VLANs. Yesterday, the switch failed and was replaced with an identical model. After restoring the configuration from a backup, all VMs on HostA are working normally, but all VMs on HostB show 'network disconnected' in the vSphere console. The VMs on HostB are still running, but they cannot communicate with any other device on the network. HostB itself is reachable via its management IP and can access the storage array. The administrator has verified that the physical cables are correct and the NICs are up on HostB. The VLAN configuration on the new switch was restored for the ports connecting HostB, but the issue persists. Which of the following actions should the administrator perform FIRST to restore connectivity?

A.Reboot HostB to renegotiate the network configuration.
B.Restart the vCenter Server service on the vCenter appliance.
C.vMotion all affected VMs from HostB to HostA to confirm they work on HostA.
D.Check the VLAN configuration on the switch ports connected to HostB for the VM network uplinks.
AnswerD

Why this answer

Option B is correct. Since all other functions (management, storage) work and only VM traffic is affected, the most likely cause is incorrect VLAN tagging on the switch port carrying the VM traffic uplink. Restoring a switch config may have missed the exact VLAN trunk settings.

Checking and correcting the VLAN configuration on the switch ports for HostB's VM network is the first targeted step. Options A and C are nondisruptive but don't address the immediate config issue. Option D involves rebooting the host without diagnosing, which is risky and may not fix the issue.

Practice this question →
120
MCQmedium

A server administrator is troubleshooting a Windows Server 2019 host that exposes an iSCSI LUN as a data volume. The volume is set to mount automatically, but after a reboot the drive letter changes and the backup job that targets E:\ fails. The administrator needs the volume to consistently receive the same drive letter after every restart. Which of the following should the administrator configure?

A.Assign the LUN as a mount point in an empty NTFS folder instead of a drive letter.
B.Create a persistent reservation on the iSCSI target for the initiator.
C.Enable the MPIO feature and add the iSCSI target as a multipath device.
D.Configure the volume with a persistent drive letter in Disk Management or diskpart.
AnswerD

Assigning a persistent drive letter binds that letter to the volume's signature and partition offset, so Windows reassigns the same letter at each boot even if other volumes appear first. This directly resolves the scenario where the volume wanders to another letter and breaks the E:\-based backup job, and it is the standard fix applied through Disk Management or the diskpart assign command.

Why this answer

Drive letters on iSCSI volumes can shift when Windows enumerates disks differently at boot, especially when other devices claim the letter first. Making the assignment persistent ties the letter to the volume itself rather than to discovery order, so the backup path stays valid. Persistent reservations, mount points, and MPIO each solve different storage problems and do not guarantee a stable drive letter.

Exam trap

The trap here is assuming that iSCSI or MPIO configuration controls drive-letter persistence, when the fix is a volume-level setting in Disk Management or diskpart.

Practice this question →
← PreviousPage 2 of 2 · 120 questions total

Ready to test yourself?

Try a timed practice session using only Troubleshooting questions.

Start 20-question session