Courseiva

CompTIA Server+ SK0-005 (SK0-005) — Questions 1–75

185 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Data quality score: 5/100 — Not ready for indexing

19 warnings found across 75 questions. This page is set to noindex until issues are resolved.

Page 1 of 3

Page 2
1
MCQeasy

A server administrator notices that a recently installed PCIe network card is not being recognized by the operating system. The server is running Windows Server 2019. The administrator has verified that the card is securely seated and that the slot is enabled in the BIOS. Which of the following should the administrator try FIRST to resolve the issue?

A.Check the Hardware Compatibility List (HCL) for Windows Server 2019.
B.Replace the network card with a known-good card.
C.Reseat the network card in a different PCIe slot.
D.Update the server BIOS to the latest version.
AnswerA

Ensuring the hardware is on the HCL verifies driver support, which is the most logical first step before further hardware or software changes.

Why this answer

Option B is correct because the first step when a newly installed device is not recognized should be to verify hardware compatibility with the operating system (checking the Hardware Compatibility List). This ensures the device has supported drivers. Options A and C are physical steps that have already been considered (secure seating, slot enabled), and D (updating BIOS) is a later step after confirming compatibility.

Full explanation →
2
MCQmedium

An administrator needs to configure a critical web service on a Linux server to automatically restart if it crashes unexpectedly. The server uses systemd. Which of the following best accomplishes this goal?

A.Set the service to run under inetd so it starts on demand
B.Write a cron job to check the service status every minute and start it if stopped
C.Configure the service's systemd unit file with Restart=always
D.Create an init.d script that loops and re-executes the service if it exits
AnswerC

Restart=always tells systemd to restart the service whenever it stops, which is the proper and most reliable way to ensure automatic recovery.

Why this answer

Option C is correct because setting Restart=always in the systemd unit file ensures the service restarts regardless of exit code, which is the proper systemd method. Option A is wrong because a cron job introduces a potential delay and is less reliable than built-in service supervision. Option B is wrong because an init.d script with a loop is an outdated approach and not recommended with systemd.

Option D is wrong because inetd starts services on demand, not for persistent daemons.

Full explanation →
3
MCQeasy

A server administrator receives an alert that a critical server's disk is almost full. Upon investigation, the administrator finds a large log file that has grown significantly. The log file is rotated daily, but today's rotation failed. Which command should the administrator use FIRST to free up space immediately?

A.logrotate -f /etc/logrotate.conf to force log rotation.
B.> /var/log/large.log to truncate the file.
C.rm -rf /var/log/large.log to delete the file.
D.mv /var/log/large.log /backup/ to move the file.
AnswerB

Redirection with > nullifies the file content immediately, freeing disk space while keeping the inode intact so processes can continue writing.

Why this answer

Option A is correct because truncating the file to zero size instantly reclaims disk space without removing the file, which could cause issues if processes still have it open. Option B is wrong because deleting the file will not free space if any process holds an open file handle. Option C is wrong because moving the file has similar issues as deletion.

Option D is wrong because running logrotate might fail if the disk is full or if the rotation script is broken; truncation is quicker and safer under pressure.

Full explanation →
4
MCQhard

A database server running on a Linux VM has started experiencing periodic crashes. The VM is hosted on an ESXi hypervisor. The system logs show entries: 'kernel: Out of memory: Kill process 12345 (mysqld) score 700 or sacrifice child'. The VM has 16GB RAM allocated and no memory overcommitment on the host. The DBA reports that the database workload hasn't increased. Which of the following actions should be taken FIRST to diagnose the issue?

A.Add a memory reservation for the VM in ESXi.
B.Check the host's memory utilization for ballooning or swapping.
C.Analyze the database query cache hit ratio and slow query logs.
D.Increase the VM's RAM allocation to 32GB.
AnswerB

Host memory pressure can force balloon driver activity or swapping, causing the VM to see less available RAM and triggering OOM. This is the correct first diagnostic step.

Why this answer

Option C is correct because the OOM killer being invoked in a VM with stable workload suggests possible host-level memory constraints (e.g., ballooning, swapping) affecting the VM. Checking the host's memory utilization helps confirm whether the hypervisor is under memory pressure and causing the VM to think it's out of memory. Options A and D are configuration changes that might alleviate symptoms but don't diagnose root cause.

B addresses database tuning, which is not indicated when the system reports OOM.

Full explanation →
5
MCQmedium

A systems administrator is configuring a new server that will host a mission-critical database. The server has two redundant power supplies. The organization's data center has two separate power circuits, each backed by a different UPS. Which of the following power configurations provides the BEST redundancy?

A.Connect each power supply to a different power circuit.
B.Connect both power supplies to a single, high-capacity UPS.
C.Use a single power supply and keep the second as a cold spare.
D.Connect both power supplies to the same circuit to balance load.
AnswerA

This is the best practice for power redundancy. It ensures that the server remains powered even if one entire circuit or UPS fails.

Why this answer

Connecting each power supply to a different power circuit ensures that if one circuit or UPS fails, the server continues to receive power from the other source. Option B is correct because it eliminates single points of failure in the power path. Option A is incorrect because connecting both to the same circuit creates a single point of failure; a circuit trip would take down the server.

Option C is incorrect because using a single live PSU with a cold spare does not provide automatic failover and would cause downtime if the active PSU fails. Option D is incorrect because a single high-capacity UPS is still a single point of failure, and does not protect against UPS failure or circuit issues.

Full explanation →
6
MCQhard

A virtualization administrator notices that a critical VM on an ESXi host has high CPU Ready time (%RDY) according to performance charts. The VM has 8 vCPUs assigned, and the host has two physical CPUs with 8 cores each. Other VMs on the host are performing normally. Which of the following actions would MOST likely resolve the high CPU Ready time for this VM?

A.Increase the number of physical cores in the host by adding another CPU.
B.Enable CPU affinity to pin the VM to specific physical cores.
C.Reduce the number of vCPUs assigned to the VM to 4.
D.Migrate the VM to another host with more available CPU capacity.
AnswerD

High CPU Ready time indicates the VM is waiting for physical CPU resources. Migrating to a less contended host resolves the issue without changing the VM's configuration.

Why this answer

Option D is correct because high CPU Ready time indicates the VM is waiting for physical CPU resources. Migrating to a less contended host allows the VM to receive adequate CPU scheduling without waiting. Option A is wrong because adding physical cores is a hardware change that may not be immediately feasible and does not address the root cause; the current host may have sufficient capacity if the VM's vCPU count is appropriate.

Option B is wrong because while CPU pinning can reduce overhead, it may not resolve contention if the host is oversubscribed; also, pinning can lead to other issues. Option C is wrong because reducing vCPUs might help if the VM is not using all vCPUs efficiently, but it could also hurt performance if the workload genuinely needs 8 vCPUs; migration is a less intrusive first step and often the recommended action in such scenarios.

Full explanation →
7
MCQmedium

A Linux server administrator notices that the /var partition is 95% full. To free space quickly, the administrator decides to delete old log files. Which of the following commands should the administrator use to find and delete log files older than 30 days in the /var/log directory?

A.rm /var/log/*.log -30
B.ls -l /var/log/*.log | grep "30" | rm
C.grep -R "30 days" /var/log | xargs rm
D.find /var/log -name "*.log" -mtime +30 -exec rm {} \\;
AnswerD

This command correctly identifies and removes log files older than 30 days without exceeding command-line limits.

Why this answer

Option A is correct. The `find` command with `-mtime +30` locates files modified more than 30 days ago, and `-exec rm {} \;` safely deletes each file. Option B is syntactically invalid.

Option C incorrectly pipes `ls` output through `grep` and then to `rm`, which does not accept piped input. Option D searches file contents for the text '30 days' rather than file age.

Full explanation →
8
MCQhard

A server has been intermittently crashing, and the system logs repeatedly show 'Machine Check Exception (MCE) errors' referencing a specific CPU core. The server is under warranty. The technician suspects a hardware fault. Which of the following actions should be taken FIRST to resolve the issue while minimizing downtime?

A.Update the server's firmware and device drivers to the latest versions.
B.Run a diagnostic stress test to confirm the CPU failure.
C.Disable the faulty CPU core in the BIOS and continue monitoring.
D.Replace the CPU with a known-good unit immediately.
AnswerB

Confirming the fault with diagnostics is the proper first step under warranty. It provides evidence for the manufacturer, ensures correct part replacement, and avoids unnecessary downtime from trial-and-error swapping.

Why this answer

Machine Check Exceptions are serious hardware errors often indicating a failing CPU or system board. Before replacing components under warranty, it is best practice to run diagnostics to confirm the failure and gather evidence for the vendor. Option D is correct because diagnosing the failure first avoids unnecessary parts replacement and provides documentation for warranty service.

Option A is incorrect because disabling the core might temporarily mask the issue but does not resolve the root cause and could degrade performance. Option B is incorrect because replacing the CPU without confirming the fault could waste time and resources if the issue lies elsewhere (e.g., motherboard). Option C is incorrect because firmware and driver updates are unlikely to fix a confirmed hardware MCE, and applying them would delay actual repair.

Full explanation →
9
MCQhard

An organization uses a cloud-based backup solution with immutable storage to protect against ransomware. However, after a recent attack, an attacker with stolen administrator credentials was able to delete the backup data. Which of the following BEST explains why the backups were deleted?

A.The backup solution did not support versioning.
B.The immutable storage policy was not configured correctly or had a retention lock that was not enabled.
C.The attacker used ransomware to encrypt the backup data at the source before it was sent.
D.The backup data was stored in a different geographic region than production.
AnswerB

Without a properly configured retention lock, even immutable storage may allow administrative deletions, defeating the purpose.

Why this answer

Option A is correct because true immutable storage prevents any deletion or modification, even by administrators, for a specified retention period. The fact that an admin could delete it indicates the immutability feature was misconfigured or not properly locked. Option B describes encryption at the source, but that would not allow deletion of existing backups.

Option C is irrelevant to deletion. Option D: versioning helps but does not prevent deletion if immutability is not configured.

Full explanation →
10
MCQmedium

A system administrator manages a collection of Linux web servers that store custom application configurations in /etc/app/config. The configuration changes frequently, and the admin needs to implement an automated daily backup solution that captures the directory at 1 AM, compresses it with gzip, and retains the last 5 days of backups on a central NFS-mounted backup volume /mnt/backups. The solution should be simple and use standard tools. Which approach best meets these requirements?

A.Create a cron job that runs `tar -czf /mnt/backups/config-$(date +%Y%m%d).tar.gz /etc/app/config` at 1 AM, and another cron job at 2 AM that runs `find /mnt/backups -name "config-*.tar.gz" -mtime +5 -delete`.
B.Use Windows Server Backup scheduled to back up the Linux server's directory via SMB share.
C.Create a cron job that runs `rsync -avz /etc/app/config /mnt/backups/` at 1 AM, with a separate cron job to delete old rsync snapshots using `find /mnt/backups -type d -mtime +5 -exec rm -rf {} \;`.
D.Write a shell script that uses `zip -r /mnt/backups/config.zip /etc/app/config`, schedule it via cron at 1 AM, and rely on the NFS server's built-in snapshot feature for retention.
AnswerA

This solution correctly creates a compressed, date-stamped archive and removes archives older than 5 days, meeting all specified requirements simply.

Why this answer

Option B is correct because it uses tar with gzip compression and a dated filename to create daily compressed archives, and a separate cron job using find to delete files older than 5 days, fulfilling all requirements simply. Option A uses rsync which does not create a single compressed archive file and the retention method using find on directories is less suitable for daily snapshot rotation. Option C uses zip which does not easily support date-stamped filenames and relies on external NFS snapshots, which is not a self-contained solution.

Option D uses Windows Server Backup on Linux, which is unsupported and inappropriate.

Full explanation →
11
MCQhard

A server has four 1 Gbps network interface cards (NICs) configured in a Link Aggregation Control Protocol (LACP) team with a managed switch. The switch ports are confirmed to be correctly configured for LACP. However, during a file transfer test, the observed aggregate throughput is only about 2 Gbps. Which of the following should the administrator verify FIRST?

A.Update the NIC drivers to the latest version
B.Examine the load-balancing algorithm on the server or switch
C.Verify the MTU settings on the NICs and switch
D.Check for Spanning Tree Protocol blockages
AnswerB

The hashing algorithm determines how traffic is distributed. An inappropriate algorithm can cause all traffic to use only a subset of links, resulting in less than the full aggregate bandwidth.

Why this answer

Option B is correct because LACP uses a load-balancing algorithm (hashing) to distribute traffic across member links. The default hash policy (e.g., Layer 2 based) may not utilize all links effectively for certain traffic patterns. Checking and adjusting the load-balancing algorithm (e.g., to Layer 2+3 or Layer 3+4) often resolves uneven distribution.

Option A (drivers) could affect teaming but less likely if the team is formed. Option C (MTU) issues would typically cause fragmentation or performance problems, not simply limiting aggregate throughput. Option D (Spanning Tree) would block ports, not limit throughput.

Option E (flow control) could affect performance but is not the most common cause of suboptimal LACP throughput.

Full explanation →
12
MCQhard

A server administrator is restoring a file server from a full backup taken 7 days ago and incremental backups taken daily. The restoration fails with an error about missing catalog files. What is the most likely cause?

A.The hard drive on the file server has failed
B.The backup software is not compatible with the current OS version
C.The full backup media is corrupted
D.The incremental backup chain is broken
AnswerD

A broken chain (e.g., a missing incremental) prevents the restore from completing, often resulting in a catalog error.

Why this answer

Restoring from incremental backups requires a complete chain from the last full backup. If any incremental backup in the chain is missing or corrupted, the restore will fail. Corrupted full backup media would cause a different error.

OS compatibility issues would likely appear earlier. Hard drive failure would be a hardware error.

Full explanation →
13
MCQhard

Refer to the exhibit. A disaster recovery test reveals the following timeline for a critical application. The business requires an RTO of 2 hours. Which of the following actions would MOST effectively reduce the RTO to meet the requirement?

A.Implement database replication to eliminate the database restore time.
B.Add more network bandwidth to speed up VM provisioning.
C.Use a warm site with pre-configured storage.
D.Automate application validation to reduce that phase by half.
AnswerA

Database replication provides a near-zero restore time, directly reducing the largest RTO component and achieving the 2-hour target.

Why this answer

Option A is correct because the database restore takes 120 minutes—the largest portion of the RTO. Replication would make the database continuously available, reducing that time to near zero and bringing total RTO to about 120 minutes (provisioning + validation) which meets the 2-hour target. Option B could reduce VM provisioning time but not address the database restore.

Option C reduces validation by 30 minutes, not enough. Option D does not significantly impact VM provisioning time, which is already only 60 minutes.

Full explanation →
14
MCQmedium

An organization requires a disaster recovery site that can be operational within 24 hours after a disaster declaration, with critical data replicated on a regular basis, but not necessarily real-time. Which type of site should they implement?

A.Warm site
B.Alternate processing site
C.Cold site
D.Hot site
AnswerA

A warm site is partially equipped and can be made operational in about 24 hours.

Why this answer

Option A is correct because a warm site provides pre-installed hardware and network infrastructure, along with data backups that can be loaded and activated within a day. Hot sites offer immediate failover but are more expensive and not necessary here. Cold sites are empty space and take weeks.

An alternate processing site is a vague term.

Full explanation →
15
MCQhard

A system administrator is configuring a backup schedule for a critical database server that must be available 24/7. The company's recovery point objective (RPO) is 1 hour and recovery time objective (RTO) is 4 hours. The database files change frequently, but the operating system and application binaries rarely change. Which of the following backup strategies would BEST meet these requirements while minimizing storage and backup window impact?

A.Full backup daily, differential backup every hour
B.Full backup weekly, differential backup every hour
C.Full backup daily, incremental backup every hour
D.Full backup weekly, incremental backup every hour
AnswerC

Daily fulls ensure fast recovery, while small hourly incrementals meet the 1-hour RPO with minimal impact on the backup window and storage.

Why this answer

Option D is correct because daily full backups provide a recent recovery base, and hourly incremental backups are small and fast, meeting the 1-hour RPO with minimal backup window. Restoration applies at most 24 incrementals to the latest full, which fits within the 4-hour RTO. Option A is wrong because weekly full backups with hourly incrementals may require restoring too many incrementals, risking the RTO.

Option B is wrong because hourly differential backups grow in size throughout the day, increasing backup time and storage. Option C is wrong because weekly fulls with hourly differentials cause exponential growth in differential size over the week.

Full explanation →
16
PBQmedium

A Windows Server 2019 file server hosts a shared folder named \\FS01\SalesDocs. The share permissions are configured to grant the 'Everyone' group Full Control. The NTFS permissions on the D:\Shares\SalesDocs folder are set as follows: The 'Sales' security group has Allow Read & Execute, List Folder Contents, and Read. The 'Managers' group has Allow Modify. A user, Alice, is a member of the 'Sales' group and also a member of the 'Temporary_Contractors' group. She recently had her account moved from the 'Contractors' OU to the 'Sales' OU. When Alice attempts to access \\FS01\SalesDocs from her Windows 10 workstation, she receives an 'Access Denied' error. Other members of the 'Sales' group can access the folder without issues. The administrator verifies that Alice's group membership includes both 'Sales' and 'Temporary_Contractors'. The effective permissions tool on the folder shows that Alice should have Read access. However, she still cannot access the share. Which of the following is the most likely cause of Alice's access denial and the appropriate next step to resolve it?

A.Alice's user token was not updated after her OU move; she needs to log off and log back on to obtain the new group membership, but the token hadn't expired. The administrator should wait or force logoff.
B.Her workstation's offline files cache is corrupt, causing access denied. The administrator should clear the CSC cache on her machine.
C.The 'Temporary_Contractors' group has an explicit Deny permission on the NTFS security for D:\Shares\SalesDocs, which overrides her Allow permissions. The administrator should remove Alice from that group or modify the Deny entry.
D.The share permissions 'Everyone Full Control' are invalid because 'Everyone' does not include authenticated users from other domains. The administrator should add 'Authenticated Users' with Change permission.
AnswerC

Why this answer

Option A is correct because an explicit Deny permission for Temporary_Contractors would override all Allow permissions, resulting in access denied despite the effective permissions tool showing allowed access (which may not account for Deny in all views). Option B is incorrect because 'Everyone' includes authenticated users, and the share permissions are permissive. Option C suggests a token issue, but effective permissions already reflect her group membership; a token issue would typically result in no access to Sales group resources, conflicting with others' access.

Option D is unlikely without other offline files symptoms.

Full explanation →
17
MCQhard

A virtualized server running multiple VMs experiences a sudden performance degradation during peak hours. Storage latency spikes and CPU ready time increases significantly. The hypervisor shows high memory overcommitment but no swapping. Which action would most likely resolve the issue without adding hardware?

A.Reduce the number of vCPUs assigned to each VM
B.Increase memory reservation for all VMs
C.Migrate one or more VMs to another host
D.Enable transparent page sharing
AnswerC

Moving VMs to another host spreads the workload, decreasing CPU contention and storage I/O load on the original host.

Why this answer

Option B is correct because migrating VMs reduces resource contention on the host, lowering CPU ready time and potentially alleviating storage I/O pressure. Option A would only address memory pressure, not CPU ready. Option C is already enabled by default and would not resolve high ready time.

Option D might help CPU contention but could degrade application performance and does not address storage latency directly.

Full explanation →
18
PBQhard

You are the lead server administrator for a mid-sized e-commerce company. The web application is hosted on a farm of four Linux servers running Apache, fronted by a hardware load balancer. The load balancer currently uses a round-robin algorithm. Recently, the customer support team has received numerous complaints about slow page load times and occasional timeouts during checkout. You log into the server monitoring console and observe that one of the web servers, web03, has a CPU utilization consistently above 95%, while the other three servers are at around 30-40%. You connect via SSH to web03 and run the 'top' command, identifying a process named 'imagick' consuming 99% CPU. Further investigation reveals that this process is related to image resizing for product thumbnails, and it appears to have entered an infinite loop due to a malformed image file. Meanwhile, the load balancer continues to send requests to all servers equally, including the overloaded web03, causing some requests to time out. You need to restore performance immediately and prevent recurrence. Which of the following actions should you take?

A.Kill the 'imagick' process on web03, change the load balancer algorithm to least connections, and clear the malformed image.
B.Reboot all four web servers to clear any stuck processes.
C.Increase RAM on web03 to handle the high CPU process better.
D.Add two more servers to the farm and keep the round-robin algorithm.
AnswerA

Why this answer

Option B is correct because it directly addresses both issues: the runaway process (killing it stops the CPU drain) and the load balancer algorithm (switching to least connections prevents sending traffic to an already overloaded server). Additionally, clearing the malformed image addresses the root cause of the loop. Option A (adding servers) may temporarily hide the problem but does not fix the load distribution or the looping process; the overloaded server would still exist.

Option C (rebooting all servers) is unnecessarily disruptive and does not address the root cause; the malformed image could trigger the loop again after reboot. Option D (increasing RAM) misidentifies the issue as memory-related when it is clearly CPU-bound; more RAM would not stop the infinite loop.

Full explanation →
19
PBQeasy

A technician receives an urgent alert that a critical file server at a remote branch office has gone offline and is unreachable over the network. The server is accessible via out-of-band IPMI, which indicates that chassis power is present, but the power LED on the server is blinking amber instead of steady green. The IPMI system event log reports "System board voltage regulator failure" as the last critical event before the failure. Attempts to use the remote KVM show no video output, and Wake-on-LAN commands have no effect. The branch office has no on-site IT personnel; the only staff are general office workers with minimal technical training. The earliest a field technician can travel to the site is 48 hours. The main office has an identically configured spare server and a backup image of the file server's system disk. The branch office staff can follow simple plug-and-play instructions if provided. Which of the following is the BEST immediate course of action to restore the file services with minimal downtime?

A.Order a replacement system board and express ship it to the branch for a technician to install later.
B.Ship the spare server and a pre-configured backup image to the branch office for local staff to swap.
C.Instruct a non-technical employee at the branch to reseat the power supply and clear the error log.
D.Dispatch a technician with a replacement voltage regulator module for on-site repair.
AnswerB

Why this answer

Given the voltage regulator failure on the system board, the server is not repairable remotely. Shipping the pre-configured spare server allows non-technical staff to swap the entire unit by following simple cabling instructions, restoring service quickly without waiting for a technician. Option A is correct because it minimizes downtime by leveraging available resources.

Option B is incorrect because voltage regulator modules are rarely field-replaceable; they are integrated into the motherboard, and dispatching a technician would take 48 hours plus repair time. Option C is incorrect because reseating the power supply is unlikely to fix a system board voltage regulator fault, and could cause further confusion for untrained staff. Option D is incorrect because ordering a replacement board and waiting for a technician to install it would take even longer, extending downtime unnecessarily.

Full explanation →
20
MCQmedium

A system administrator is notified that a server with a RAID 5 array of four 2TB drives has a single failed drive. The server uses hot-swappable drives and a hardware RAID controller. Which of the following actions should the administrator perform FIRST?

A.Replace all four drives with larger capacity drives to expand storage.
B.Reboot the server and enter the RAID controller BIOS to mark the drive as offline.
C.Replace the failed drive and allow the array to rebuild.
D.Perform a full backup of the array before taking any action.
AnswerC

Immediate replacement allows the rebuild process to start, restoring redundancy. Hot-swap capability makes this a quick, non-disruptive first step.

Why this answer

Option A (Replace the failed drive and allow the array to rebuild) is correct because with a hot-spare, the array can rebuild automatically after replacing the failed drive, minimizing data vulnerability. Option B (Perform a full backup) is prudent but not immediate; the array is still functional in degraded mode. Option C (Reboot the server and access the RAID controller BIOS) delays recovery and may cause unnecessary downtime.

Option D (Replace all drives to increase storage) is unnecessary and wasteful.

Full explanation →
21
MCQhard

An organization stores backup tapes at an offsite facility. The tapes contain sensitive customer data. A security audit revealed that tapes were stolen from the facility. Which combination of measures would have MOST effectively prevented unauthorized data access?

A.Encrypt all backup data with strong encryption and restrict decryption keys to authorized personnel.
B.Password-protect the tapes and keep them in a locked safe.
C.Store tapes in a fireproof safe and limit access to key personnel.
D.Use a bonded courier service for transportation.
AnswerA

Encryption is the only measure that directly protects data confidentiality even if physical media is stolen, as decryption requires the keys.

Why this answer

Option D is correct because encrypting the backup data and restricting decryption keys ensures that even if the tapes are physically stolen, the data remains unintelligible without the keys. Option A (password protection) can often be bypassed and does not secure the data itself. Option B only secures transport, not storage.

Option C provides physical security but would not deter a determined thief and does not protect the data if the safe is compromised.

Full explanation →
22
MCQeasy

Refer to the exhibit. A server in a well-maintained data center has triggered upper critical and non-recoverable temperature alerts for CPU1. The server's chassis fans are operating at full speed, and the data center ambient temperature is normal. Which of the following is the FIRST action the administrator should take?

A.Open the chassis and verify that the CPU air baffle/duct is in place.
B.Check for failure of the liquid cooling system for CPU1.
C.Replace CPU1 because the high temperature indicates an internal short.
D.Install additional high-speed fans to increase static pressure.
AnswerA

Air baffles direct airflow over the CPU heatsinks; if missing or displaced during a previous service, the CPU can overheat even with fans at full speed.

Why this answer

Correct: Missing or improperly installed air baffles/ducts are a common cause of CPU overheating, especially after maintenance. Option A is wrong because if other components are fine, a liquid cooling failure is less likely and more invasive. Option C is wrong because adding extra fans doesn't address the root cause if airflow path is broken.

Option D is wrong because a failed CPU almost never causes overheating; a failing CPU usually causes crashes, not thermal runaway.

Full explanation →
23
MCQhard

A server in a virtualized environment is experiencing VM performance degradation. The host server has adequate resources. The hypervisor logs show excessive 'ready' time for the CPU. Which of the following is the BEST action to resolve this issue?

A.Disable hyper-threading on the host
B.Increase the number of vCPUs for the VM
C.Reduce the number of VMs on the host
D.Migrate the VM to a different host
AnswerC

Correct. Reducing the number of VMs decreases CPU contention and lowers ready time, improving performance.

Why this answer

Reducing the number of VMs on the host reduces contention for CPU resources, decreasing ready time.

Full explanation →
24
PBQeasy

A company has an internal web application running on a Windows Server 2019 IIS server. Recently, users have been experiencing intermittent slow responses and occasional '503 Service Unavailable' errors. The server has 32 GB RAM and currently hosts only this application. The application pool is configured to use a private memory limit of 2 GB and a request queue limit of 1000. Performance monitoring reveals that the application pool's private memory gradually increases over several hours until it reaches 2 GB, at which point the pool recycles. The slow responses and errors coincide with the recycling events. The administrator suspects a memory leak in the application code but cannot modify the application immediately. The server must remain available during business hours (8 AM to 8 PM). Which of the following is the best short-term mitigation?

A.Use a script to stop and start the application pool service every hour
B.Increase the physical RAM to 64 GB and raise the private memory limit to 4 GB
C.Configure Performance Monitor alerts to recycle the application pool when memory usage reaches 1.8 GB, and schedule it during low-usage hours
D.Schedule a nightly reboot of the server to clear memory and reset the application pool
AnswerC

Why this answer

Option A is correct because monitoring the memory usage and triggering a graceful recycle before hitting the limit can prevent sudden 503 errors and maintain availability, and it can be scheduled during off-peak times. Option B is wrong because scheduling a reboot requires downtime. Option C is wrong because adding RAM does not fix a memory leak; the pool will still hit its limit and recycle.

Option D is wrong because restarting every hour would cause frequent disruptions and is not user-friendly.

Full explanation →
25
MCQhard

A server administrator is troubleshooting a performance issue on a VMware vSphere host. The host has multiple VMs, and one VM is experiencing high latency on its virtual disk. The administrator checks the datastore and sees it is a RAID 5 array of 4 SAS drives with 50% utilization. Latency for the VM's virtual disk is reported as 200ms. Which action would most likely improve performance?

A.Add a second disk to the RAID 5 array (convert to RAID 6).
B.Migrate the VM to a different datastore with SSD storage.
C.Increase the VM's memory allocation.
D.Change the virtual disk type from thin to thick.
AnswerB

SSD storage provides much lower latency than SAS spinning disks, directly addressing the high latency.

Why this answer

High latency on a heavily utilized RAID 5 array of spinning disks suggests an I/O bottleneck. Migrating to SSD storage would significantly reduce latency. Option A addresses memory, not disk; B might help with allocation but not latency; C might increase capacity but not improve latency (RAID 6 has more overhead).

Full explanation →
26
MCQeasy

Refer to the exhibit. A backup administrator scheduled a nightly backup to a network share. The backup job fails with the error shown in the log. What is the most likely cause?

A.The backup destination disk is full
B.The network share is offline
C.The service account lacks write permissions to the share
D.The backup software is not installed
AnswerC

“Access denied” clearly indicates a permissions problem, and the backup account does not have the necessary rights.

Why this answer

Option C is correct because the “Access denied” message indicates a permissions issue, likely that the service account running the backup lacks write access to the share. The share being offline would likely show “network path not found,” a full disk would show “insufficient space,” and the software not installed would prevent the job from running at all.

Full explanation →
27
PBQeasy

A small accounting firm has a single server that hosts their client database and financial applications. The server is backed up nightly using a full backup to an external USB hard drive, which is stored on a shelf next to the server. Last month, a fire broke out in the office, completely destroying the server and the backup drive. The company lost all data since their last offsite backup, which was six months old because they occasionally took a copy home. The business owner wants to prevent such a catastrophic data loss in the future but is concerned about cost and complexity. They have a limited IT budget and no dedicated IT staff. The firm operates 9-5 Monday to Friday, and can tolerate up to 24 hours of downtime and up to one day of data loss. After the fire, they had to rebuild their client records from paper files, which took weeks. The owner realizes the importance of an offsite backup routine but cannot afford an expensive cloud service or a second server. The firm's internet connection is a basic DSL line with limited upload bandwidth, making large cloud backups slow. The server has a single internal drive with enough free space to store additional copies. Which of the following backup strategies would best meet the firm’s recovery objectives while minimizing cost and complexity?

A.Buy a second external drive, alternate them, and keep one offsite at the owner’s house, rotating weekly.
B.Continue nightly full backups to an external drive, but have an employee take the drive home every evening.
C.Purchase a network-attached storage device and configure it to receive daily backups; place it in a different room in the building.
D.Subscribe to a cloud backup service and perform daily incremental backups over the internet.
AnswerB

Why this answer

Option B is correct because it provides a daily offsite backup, limiting data loss to at most 24 hours, which meets the RPO. It requires minimal additional cost (just the external drive) and no complex technology, fitting the firm's budget and lack of IT staff. Option A (cloud backup) would exceed the slow internet connection's capability and likely incur ongoing subscription costs, making it less suitable.

Option C (NAS in another room) does not protect against a site-wide disaster like fire, so it fails to provide offsite redundancy. Option D (weekly rotation) would result in an offsite copy that is up to a week old, violating the one-day RPO.

Full explanation →
28
PBQeasy

A small law firm has a single Windows Server 2016 Essentials server that functions as a domain controller and file server. After a sudden power outage over the weekend, the server does not boot normally. Instead, it displays a black screen with the message: 'BOOTMGR is missing. Press Ctrl+Alt+Del to restart.' The IT support specialist arrives on Monday morning to find the server in this state. The firm's operations are at a standstill because all case files and email archives are inaccessible. The specialist has access to the Windows Server 2016 installation media and a recent system state backup stored on an external drive. The server hardware passed POST, and all disks are detected in the BIOS. The specialist needs to restore the server's ability to boot into Windows as quickly as possible, with minimal risk to existing data. Which of the following procedures should the specialist perform FIRST?

A.Connect the external backup drive, boot from the installation media, and perform a full system restore from the backup.
B.Open the server case, reseat the RAM modules and SATA cables, and then attempt to boot again.
C.Boot from the installation media, select 'Repair your computer', and from the Command Prompt run 'bootrec /fixmbr' and 'bootrec /fixboot'.
D.Press F8 during startup to access Advanced Boot Options and select 'Last Known Good Configuration'.
AnswerC

Why this answer

Option C is correct because the 'BOOTMGR is missing' error typically indicates a corrupt master boot record or boot sector. Using bootrec /fixmbr and /fixboot from the installation media repairs the boot files without affecting data. Option A is a full system restore, which risks data loss and is overkill.

Option B is hardware reseating, unnecessary since POST passed. Option D, Last Known Good Configuration, does not fix missing boot manager files.

Full explanation →
29
MCQmedium

A server administrator is responsible for protecting sensitive data. The backup process copies files to a network share daily. Which of the following should the administrator do to BEST ensure the confidentiality of the backup data both during transfer and at rest?

A.Configure the network share with SMB encryption only.
B.Use a dedicated NIC for backup traffic on an isolated VLAN.
C.Place the backup server in a physically locked cage with restricted access.
D.Encrypt the backup files before transfer using a tool like GPG, and store them encrypted.
AnswerD

Pre-transfer encryption protects data confidentiality both in transit and at rest on the backup media.

Why this answer

Encrypting the backup files before transfer (Option B) ensures data confidentiality during transit and while stored on the backup server. Option A provides network segmentation but no encryption. Option C encrypts only the transfer, not the data at rest.

Option D is a physical security measure and does not encrypt the data.

Full explanation →
30
MCQmedium

A financial services firm requires zero data loss in the event of a primary data center failure. They operate two data centers 50 miles apart connected by a high-bandwidth, low-latency link. Which replication method should they use to meet this requirement?

A.Asynchronous replication every 15 minutes
B.Snapshot replication every hour
C.Backup replication nightly
D.Synchronous replication
AnswerD

Synchronous replication ensures that any write is committed to both replicas before being acknowledged, thus achieving RPO=0.

Why this answer

Option B is correct because synchronous replication writes data to both sites before acknowledging the write to the application, ensuring zero data loss (RPO=0). Asynchronous replication (Option A) introduces a delay and can lose the latest transactions. Snapshot replication (Option C) is point-in-time and not continuous, leading to potential data loss between snapshots.

Backup replication nightly (Option D) can lose up to a day's data.

Full explanation →
31
MCQeasy

A database server hosts a critical application that requires a recovery point objective (RPO) of 4 hours. The company wants to minimize the impact on production performance during backups. Which backup strategy should be implemented?

A.Continuous data protection (CDP) with synchronous replication.
B.A weekly full backup with daily differential backups.
C.A weekly full backup with hourly incremental backups.
D.A nightly full backup.
AnswerC

Hourly incrementals ensure that no more than 1 hour of data is lost (well within the 4-hour RPO) and have minimal impact on production because they only back up changed data.

Why this answer

Option C is correct because hourly incremental backups meet the 4-hour RPO while minimizing resource usage compared to more frequent full backups or continuous replication. Option A is wrong because differential backups grow in size and can still exceed the RPO window. Option B is wrong because nightly full backups would fail to meet the 4-hour RPO if a disaster occurs hours after the last backup.

Option D is wrong because CDP with synchronous replication imposes high performance overhead and is unnecessary beyond the 4-hour RPO requirement.

Full explanation →
32
MCQmedium

After a thunderstorm, a server in a remote office is reachable via remote console but has no network connectivity. The network switch port shows a steady link light, but the server's NIC shows no link light. Which of the following is the MOST likely cause?

A.TCP/IP stack corruption.
B.Switch port is administratively disabled.
C.Incorrect VLAN assignment on the switch port.
D.The NIC hardware has failed.
AnswerD

A failed NIC would not establish a link, explaining why the switch sees a link but the server does not—the fault lies between the server's NIC port and the cable.

Why this answer

Option C is correct. A lack of link light on the server's NIC while the switch has a link indicates a physical failure between the NIC and the cable, such as a damaged NIC. Option A would result in no link on the switch as well.

Option B would still allow the NIC to establish link. Option D would not affect link lights.

Full explanation →
33
PBQhard

A company operates a Windows Server 2019 machine that functions as a domain controller and file server. Over the past week, the server has randomly rebooted several times, often during periods of heavy file access. The administrator reviews the System event log and finds multiple Event ID 41 (Kernel-Power) entries with no preceding critical errors. The server is connected to an uninterruptible power supply (UPS) that reports stable input voltage. The server room temperature sensors indicate normal ambient temperature (22°C / 72°F). The server hardware is three years old and has not had any recent changes. The administrator has already run a full antivirus scan with no threats found. Which of the following should the administrator do NEXT to diagnose the issue?

A.Inspect and clean the CPU and chassis fans, and check for dust buildup
B.Update the server's BIOS to the latest version
C.Replace the power supply unit
D.Disable the automatic restart feature in System Properties
AnswerA

Why this answer

Option C is correct because random reboots with Kernel-Power 41 often indicate overheating due to failing fans or dust buildup, even if ambient temperature is normal. Option A is wrong because the power supply is likely not the issue given the UPS stability. Option B is wrong because a BIOS update is unlikely to solve hardware overheating.

Option D is wrong because disabling automatic restart only hides the symptom and does not prevent the reboots.

Full explanation →
34
PBQmedium

A healthcare provider is reviewing its disaster recovery strategy. They have two data centers: one primary in City A and a secondary in City B, 200 miles apart. Currently, they perform daily backups that are replicated to City B each night. In the event of a primary site failure, they can fail over to City B, but there is a 4-hour RTO due to manual processes. Their new RTO target is 2 hours, with an RPO of 15 minutes. The IT team is considering various replication technologies. The provider runs a mix of Windows and Linux servers hosting electronic health records (EHR), PACS imaging, and billing applications. Their current backup scheme is a full backup each night, with transaction logs backed up every 6 hours, but these are not immediately shipped offsite. They have experienced power outages in City A, prompting the review. The IT director is concerned about data consistency and quick recovery. The secondary site currently has sufficient hardware to run all critical applications, but data is only updated nightly. The link between data centers has 100 Mbps bandwidth and 10 ms latency, and upgrading it would cost $50,000. The existing staff can script failover procedures. Which solution best meets the new RPO and RTO while staying within budget?

A.Use application-level log shipping from the primary databases to secondary with a 5-minute delay, and manually failover.
B.Increase backup frequency to every 4 hours and use a warm site with pre-staged hardware, keeping the manual failover process.
C.Upgrade the inter-site link to 1 Gbps and implement synchronous replication for all critical VMs.
D.Implement asynchronous block-level replication with a 15-minute lag, and automate failover scripts to reduce RTO.
AnswerD

Why this answer

Option A is correct because asynchronous block-level replication with a 15-minute lag directly meets the RPO, and combining it with automated failover scripts can achieve the 2-hour RTO without requiring a costly bandwidth upgrade. Option B would meet the requirements but the link upgrade and synchronous replication infrastructure exceed the budget. Option C fails the RPO (4-hour backups are too infrequent) and RTO (manual failover is 4 hours).

Option D uses application log shipping that is not comprehensive (misses other servers) and manual failover would not meet the RTO.

Full explanation →
35
MCQmedium

A system administrator configures full backups on Sunday evenings and differential backups on weekdays. On Thursday morning, a disk failure occurs. Which of the following sets of backups is necessary to completely restore the server's data with the fewest number of backup files?

A.Sunday full only
B.Sunday full, Monday differential, Tuesday differential, Wednesday differential
C.Sunday full and Thursday differential
D.Sunday full and Wednesday differential
AnswerD

Correct. Wednesday's differential contains all changes since Sunday, so only these two files are required for a full restore.

Why this answer

A differential backup includes all changes since the last full backup. Therefore, only the most recent differential and the last full backup are needed for a complete restore. Using Sunday's full and Wednesday's differential requires just two files, whereas incremental backups would require the full plus every incremental since.

Option A (full plus all four differentials) is unnecessary. Option C references a Thursday backup that hasn't occurred yet. Option D ignores all changes since Sunday.

Full explanation →
36
MCQmedium

A company performs full backups every Sunday and differential backups daily. After a ransomware attack, they discover that both the production data and all attached backup media were encrypted. They need to ensure data can be recovered in the future. Which of the following is the BEST change to their backup strategy?

A.Store backups on an air-gapped or offline system.
B.Encrypt the backup data using AES-256.
C.Perform full backups daily instead of weekly.
D.Switch from differential to incremental daily backups.
AnswerA

Air-gapped backups are physically disconnected from the network, making them immune to remote ransomware attacks and ensuring data recoverability.

Why this answer

Option D is correct because air-gapped backups are physically isolated and cannot be reached by ransomware, ensuring recoverability. Option A increases backup frequency but doesn't protect against ransomware that encrypts attached media. Option B changes backup type but still leaves backups online and vulnerable.

Option C protects data at rest but if the encryption keys are on the same system, they can be compromised, and encryption itself doesn't prevent deletion/encryption by ransomware.

Full explanation →
37
PBQhard

A company runs a popular public-facing e-commerce website hosted on a farm of five Windows Server 2019 web servers behind a hardware load balancer. Recently, users have been reporting intermittent '503 Service Unavailable' errors during peak shopping hours. The administrator checks the load balancer and finds that all servers are marked as healthy with low CPU and memory usage. However, when inspecting a sample server, the administrator notices a large number of TCP connections in the TIME_WAIT state, consuming all available ephemeral ports. The application is ASP.NET based and uses IIS. The server configuration is as follows: Windows Server 2019 Standard, 4 vCPUs, 16 GB RAM, default TCP/IP settings. The administrator needs to resolve the connectivity issues without making changes to the application code or altering the network architecture. Which of the following actions should the administrator take to fix the problem PERMANENTLY?

A.Add two additional web servers to the farm to distribute the load.
B.Increase the ephemeral port range using netsh, and consider reducing the TIME_WAIT delay via registry settings.
C.Schedule a nightly restart of the IIS application pools.
D.Reduce the maximum number of concurrent connections in the IIS application pool settings.
AnswerB

Why this answer

Option A is correct because ephemeral port exhaustion is the root cause. Increasing the ephemeral port range provides more ports, and reducing TIME_WAIT delay frees them faster. Option B adds servers, which is a temporary workaround and does not prevent port exhaustion on each server.

Option C requires nightly restarts, causing brief outages and not solving the underlying issue. Option D limits concurrent connections but may degrade performance and does not address port exhaustion.

Full explanation →
38
MCQhard

A company performs annual disaster recovery tests. The last test revealed that the recovery time objective (RTO) was not met because the backup tapes were corrupted. The backup administrator proposes changes to the backup verification process. Which practice is MOST effective to ensure recoverability?

A.Perform a full backup more frequently.
B.Implement automated integrity checks and periodic test restores.
C.Switch to disk-based backups exclusively.
D.Store backup tapes offsite only after verification.
AnswerB

Integrity checks (e.g., checksums) verify that backup data matches the expected state, and test restores confirm that the data can actually be recovered, addressing both media and logical corruption.

Why this answer

Option B is correct because automated integrity checks and periodic test restores directly validate that backups are usable and meet recovery objectives, catching corruption early. Option A is wrong because increasing backup frequency does not verify that backups are error-free. Option C is wrong because verifying tapes before offsite storage reduces risk but does not guarantee ongoing media integrity; tapes can degrade over time.

Option D is wrong because switching to disk-based backups avoids some tape-specific issues but still requires verification processes to ensure data is not corrupted.

Full explanation →
39
PBQeasy

A small business relies on a single Dell PowerEdge T340 tower server running Windows Server 2019 as its primary domain controller and file server. The server is situated in a locked, air-conditioned IT closet and is protected by an online surge protector. During a severe thunderstorm last evening, the building experienced a momentary power loss. This morning, the administrator found the server completely powered off. When the power button is pressed, the front panel diagnostic LEDs briefly illuminate, and all internal cooling fans start spinning for about two to three seconds, but then the server abruptly powers down. There are no audible beep codes, and the monitor never receives a video signal. The administrator has already verified the power cable is firmly seated in both the server and the surge protector, swapped the power cable with a known-good one, and tested the surge protector with another device, which powered on normally. No spare parts are immediately available, and server downtime must be kept to a minimum. What should the administrator do FIRST to diagnose and resolve the problem?

A.Replace the power supply with a compatible, known-good unit.
B.Swap the motherboard with an identical one from a spare parts inventory.
C.Connect the server directly to a different power outlet, bypassing the surge protector.
D.Remove the server's RAM modules and reinstall them one at a time, testing after each.
AnswerA

Why this answer

Option B is correct: the brief fan spin with immediate shutdown and absence of POST is a classic sign of a failing power supply that cannot maintain output under load. After a power surge, the power supply is the most probable damaged component. Option A is wrong because motherboard failure would typically produce beep codes or consistent power without POST, and swapping it is high-effort without first testing the power supply.

Option C is wrong because RAM issues usually generate beep codes or a continuous power-on state with no boot, not the described brief spin-down. Option D is wrong because the administrator already confirmed other devices work on the same circuit, ruling out a supply-side issue.

Full explanation →
40
PBQeasy

A small law firm relies on a single server that hosts a document management system and email. The server is backed up nightly using differential backups to an external USB hard drive that remains connected to the server. One Monday morning, the office manager finds all files encrypted and a ransom note on the screen. The server’s event logs indicate that the encryption began at 2:00 AM on Saturday. The firm’s offsite backup policy rotates two sets of tapes, and the most recent set was taken offsite on Friday evening and is stored in a bank safe deposit box. The USB backup drive, still attached to the server, shows its files also encrypted. The firm does not have a cloud backup service for the server. The office manager wants to restore operations as quickly as possible with minimal data loss and zero risk of reinfection. What is the BEST course of action?

A.Restore the server from the firm's cloud backup service for email.
B.Scan the USB drive with antivirus, then restore the latest differential backup from it.
C.Pay the ransom to obtain the decryption key, then perform a full backup.
D.Reimage the server, then restore data from the Friday offsite tape backup.
AnswerD

Why this answer

A is correct. The offsite tape backup from Friday evening is air-gapped and predates the infection (Saturday 2:00 AM), ensuring it is clean. Reimaging the server provides a known-good operating system.

Option B is risky because the USB drive’s backup likely contains infected files; even an antivirus scan might not detect all ransomware artifacts. Option C is not possible since there is no server cloud backup. Option D is not recommended and may not result in file recovery.

Thus, A is the safest and most reliable method.

Full explanation →
41
PBQmedium

A database administrator notices that the primary SQL Server instance has been experiencing severe performance degradation over the past hour. The server is a virtual machine with 8 vCPUs and 64 GB of RAM, and it normally operates with around 40% CPU utilization. Currently, Task Manager shows 100% CPU usage, with the sqlservr.exe process consuming nearly all cycles. The database response times have increased tenfold, and some queries are timing out. There are no scheduled maintenance jobs running, and the transaction log backup completed successfully earlier. The DBA checks active sessions and finds one long-running ad-hoc query from a new reporting tool that was deployed this morning. The query is performing a cross join on two large tables with missing WHERE clauses, causing a Cartesian product. Ending the session will roll back the query and free resources.

A.Increase the virtual machine's memory allocation from 64 GB to 128 GB to reduce paging.
B.Immediately add more vCPUs to the virtual machine to handle the increased load.
C.Identify and kill the offending long-running query using the SQL Server management tools.
D.Restart the SQL Server service to clear all active connections and start fresh.
AnswerC

Why this answer

Option A is the correct immediate action. Identifying and terminating the specific offending query is the fastest way to restore normal operation without disrupting other database activities. Option B (adding vCPUs) is not a quick fix and doesn't address the root cause.

Option C (restarting the SQL service) will disconnect all users and cause unnecessary downtime. Option D (increasing the VM's memory) won't help a CPU-bound problem caused by an inefficient query.

Full explanation →
42
MCQhard

A server that uses iSCSI storage has suddenly lost connectivity to all LUNs. The network team confirms no changes have been made. Which of the following is the FIRST step in troubleshooting this issue?

A.Check the VLAN configuration on the switch.
B.Replace the network cables to the storage array.
C.Verify the status of the iSCSI initiator service on the server.
D.Reconfigure the IP address of the server.
AnswerC

A stopped or failed initiator service would immediately sever all iSCSI connections, making this the logical first check.

Why this answer

Option A is correct because the iSCSI initiator service must be running to connect to targets; verifying its status is a quick, non-disruptive first check on the local server. Option B: replacing cables is premature when there are no network changes and problem is confined to this server. Option C: changing the IP address would likely break other services.

Option D: VLAN issues would normally affect multiple devices and are less likely if the network team reports no changes.

Full explanation →
43
MCQeasy

After a power outage, a server fails to boot and displays a "Missing operating system" error. The server uses RAID 1 for the OS disk. The administrator verifies both drives are present in the RAID configuration utility but one drive is marked as failed. What should the administrator do FIRST?

A.Boot from a Windows recovery media and run chkdsk
B.Check the boot order in BIOS/UEFI
C.Reseat the failed drive and attempt to boot
D.Replace the failed drive and rebuild the array
AnswerB

Power loss can reset BIOS settings; verifying the boot order ensures the system looks for the OS on the correct drive.

Why this answer

Option C is correct because the system may be trying to boot from an incorrect device, especially after a power event may have reset BIOS settings. Option A is a later step if the array is truly broken. Option B is not the first step because the array itself may be bootable.

Option D is unlikely to restore a failed drive.

Full explanation →
44
MCQmedium

A system administrator needs to apply critical security patches to a production web server that cannot be taken offline. The server runs a Linux operating system and hosts a high-availability website. The administrator wants to ensure that if the patches cause a failure, the server can be quickly rolled back to its previous state. Which of the following actions should the administrator take FIRST?

A.Back up all user data to a network share.
B.Schedule a maintenance window and notify users of potential downtime.
C.Take a snapshot of the server's virtual machine before applying patches.
D.Apply the patches during off-peak hours without any additional steps.
AnswerC

A snapshot captures the entire VM state, including OS and applications, enabling a fast and complete rollback.

Why this answer

Option B is correct because taking a snapshot provides a point-in-time state of the virtual machine, allowing quick rollback if the patches cause issues. Option A backs up user data but does not capture the system state needed for a full rollback. Option C is a procedural step but not the first technical action to enable recovery.

Option D is reckless and provides no rollback capability.

Full explanation →
45
Multi-Selecthard

Which THREE of the following are typically essential elements of a disaster recovery plan (DRP)? (Choose three.)

Select 3 answers
A.Emergency contact and communication plan
B.Server hardware specifications
C.Test and exercise schedule
D.Network topology diagram
E.Business impact analysis (BIA)
AnswersA, C, E

This plan ensures that all stakeholders can be notified and coordinated during a disaster, a core element of DRP.

Why this answer

Options A, C, and E are correct. A business impact analysis (A) identifies critical functions and recovery priorities. An emergency contact and communication plan (C) ensures key personnel are reachable.

A test and exercise schedule (E) validates the plan's effectiveness. Server hardware specifications (B) are operational details, not a core DRP element. A network topology diagram (D) supports recovery but is not always considered an essential DRP component; it is supplementary.

Full explanation →
46
MCQeasy

A server in the datacenter fails to power on after a scheduled power maintenance. The facility team confirms that power is being supplied to the rack. The server's front panel LED is not illuminated. Which of the following should the administrator check FIRST?

A.Reseat the CPU and memory modules.
B.Verify that the power cable is securely connected to the server and the PDU.
C.Replace the power supply unit.
D.Update the server's BIOS firmware.
AnswerB

Checking physical power connections is the most logical first step in a no-power situation, as cables can become loose during maintenance activities.

Why this answer

Option C is correct because, when a server shows no signs of power (no LED), the first and simplest check is to ensure the power cable is securely connected at both ends. Option A is premature; replacing the power supply should only be attempted after ruling out simple physical connections. Option B is unrelated to a no-power scenario.

Option D would not cause a complete lack of power.

Full explanation →
47
PBQeasy

A junior system administrator is managing a Linux file server running CentOS 7 with logical volumes managed by LVM. The server hosts home directories for 200 users on the /dev/vg_users/lv_home logical volume, mounted at /home. Yesterday, the administrator created an LVM snapshot named home_snap_20250101 of the home logical volume using `lvcreate -L 5G -s -n home_snap_20250101 /dev/vg_users/lv_home` to prepare for a scheduled maintenance. This morning, during a misoperation, the administrator accidentally ran `rm -rf /home/user123`, permanently deleting user123's home directory and all its contents. The snapshot still exists and contains the pre-deletion state of the entire logical volume. The administrator has root access and needs to restore the /home directory to its state as of the snapshot time to recover the lost data. All users are currently logged out and the server can be briefly taken offline if needed. Which of the following procedures should the administrator follow to restore the home directory data from the snapshot with minimal impact and risk?

A.Delete the current /home logical volume and create a new one from the snapshot, then restore the data using `dd if=/dev/vg_users/home_snap_20250101 of=/dev/vg_users/lv_home`.
B.Create a new logical volume from the snapshot using `lvconvert --splitsnapshot`, mount it, and restore only user123's directory, then update /etc/fstab to use the new volume.
C.Mount the snapshot volume to /mnt/snap, copy the entire contents back to /home using `cp -a /mnt/snap/* /home/`, then unmount the snapshot and remove it.
D.Verify the snapshot is intact, then unmount /home, merge the snapshot back into the original logical volume using `lvconvert --merge vg_users/home_snap_20250101`, which will roll back the /home LV to the snapshot state, then remount /home.
AnswerD

Why this answer

Option B correctly uses the LVM merge feature, which reverts the original logical volume to the snapshot state. This is the intended and efficient method for snapshot recovery, requiring only a temporary unmount. Option A manually copies data, which is time-consuming and may introduce permission issues.

Option C creates a new volume unnecessarily, complicating restoration. Option D uses dd, which is risky and not a standard LVM restoration method.

Full explanation →
48
MCQhard

A server has been experiencing random crashes and generating memory-related errors in the system event log. The technician has already run memory diagnostics which show frequent errors on a single DIMM. The server has four DIMMs installed. Which of the following is the BEST next step?

A.Update the BIOS firmware
B.Replace all four DIMMs to prevent future issues
C.Replace the failing DIMM with a known good, matching module
D.Reseat all DIMMs and re-run diagnostics
AnswerC

Targeted replacement of the defective component is the most efficient and appropriate resolution after diagnostic confirmation.

Why this answer

With diagnostics confirming errors on a specific DIMM, the best action is to replace that faulty module. Reseating may not fix a physical failure. Updating BIOS or replacing all DIMMs is unnecessary and could be wasteful.

Full explanation →
49
MCQeasy

A server administrator is troubleshooting an issue where a database server's performance degrades every night at 2 AM. Resource monitor shows high disk I/O and CPU usage during that time. There are no scheduled tasks on the server. Which of the following should the administrator investigate FIRST?

A.Network congestion from backups
B.Disk defragmentation tasks
C.A cron job misconfiguration
D.Scheduled antivirus scans on the server
AnswerD

Many antivirus solutions have a default scan schedule; even without local tasks, managed scans can run at 2 AM and heavily use disk and CPU.

Why this answer

Option A is correct because centrally managed antivirus software may perform scans at a default time, causing high resource usage. Option B would result in network utilization, not local disk I/O. Option C is possible but typically scheduled and would appear in the task scheduler.

Option D contradicts the statement that no scheduled tasks exist.

Full explanation →
50
MCQhard

A server has two NICs configured in a team using LACP. The server loses network connectivity when one NIC is physically disconnected, even though both links show as active in the teaming software before the failure. What is the most likely cause of the issue?

A.LACP is not correctly configured on the switch
B.The teaming mode is set to 'Switch Independent' instead of LACP
C.Spanning Tree Protocol is blocking the failover path
D.NIC driver version mismatch between the two adapters
AnswerA

Without the switch-side LACP configuration, the switch treats the links as independent, and removing one may cause the remaining link to be unable to carry traffic, leading to connectivity loss.

Why this answer

For LACP to work properly, the switch must be explicitly configured to bundle the ports into a port channel. If the switch is not configured for LACP, it may not handle the failover correctly, causing a loss of connectivity when one link drops. NIC driver issues or STP are less likely to cause this specific symptom, and setting the team to Switch Independent would not use LACP.

Full explanation →
51
MCQhard

A server uses NIC teaming with LACP (802.3ad) for load balancing and failover. After replacing a failed switch with a new switch of the same model, the server loses network connectivity. The switch ports show no activity. Which of the following is the MOST likely cause?

A.The switch ports are not configured as access ports.
B.The new switch has a different firmware version.
C.The server's NIC teaming mode is set to active/passive.
D.LACP is not enabled on the switch ports.
AnswerD

LACP requires configuration on the switch; default is no LACP, so the switch does not negotiate the port-channel, leading to no connectivity.

Why this answer

LACP must be explicitly enabled and configured on switch ports to form a port-channel (Option D). New switches ship with default configurations that do not include LACP. The server's NIC teaming mode (Option A) was previously working, so it is likely correct.

Access port configuration (Option B) would affect VLAN membership but not completely drop traffic. Firmware differences (Option C) rarely cause total loss of connectivity without other configuration mismatches.

Full explanation →
52
MCQhard

Several users report sluggish performance from a database server. The server administrator notices that the CPU fans are running at maximum speed and the baseboard management controller (BMC) reports CPU temperatures of 85°C even at idle. The administrator already cleaned dust from the chassis and verified all fans are operational. Which of the following should the administrator do NEXT?

A.Add additional case fans to improve airflow.
B.Replace the CPU fans with higher RPM models.
C.Reapply thermal paste on the CPU heat sinks.
D.Increase the fan speed thresholds in the BIOS.
AnswerC

Thermal paste degrades over time. Reapplying it is the standard next step after basic airflow issues have been ruled out.

Why this answer

High temperatures persist after cleaning and fan checks suggest poor heat conduction between the CPU and heatsink, typically caused by dried or inadequate thermal paste.

Full explanation →
53
MCQhard

A VMware ESXi host runs six virtual machines, each configured with 8GB of RAM, totaling 48GB allocated. The host physically has 32GB of RAM, and memory overcommitment is enabled. Recently, a critical VM experienced severe performance degradation during peak hours, with the guest OS showing high memory pressure and balloon driver activity, while other VMs showed moderate usage. Which of the following actions will BEST resolve the issue without compromising other VMs?

A.Purchase and install an additional 32GB of physical RAM in the host.
B.Disable the VMware balloon driver on all virtual machines.
C.Configure a memory reservation of 8GB for the critical VM.
D.Reduce the CPU limit on the non-critical VMs during peak hours.
AnswerC

A reservation grants the VM guaranteed access to physical RAM, protecting it from ballooning and hypervisor swapping, thus stabilizing performance.

Why this answer

Option B (Set a memory reservation equal to its configured 8GB on the critical VM) is correct because it guarantees physical RAM for that VM, preventing the balloon driver from reclaiming its memory and reducing hypervisor swapping. Option A (Increase host RAM) would solve it broadly but is not the most immediate, targeted action and may not be feasible. Option C (Disable balloon driver on all VMs) could cause host swapping, degrading all VMs.

Option D (Reduce CPU limits) does not address memory contention.

Full explanation →
54
MCQeasy

A server administrator is tasked with ensuring that a critical database server remains available in the event of a hardware failure. The solution must provide automatic failover with minimal administrative overhead. Which of the following should be implemented?

A.Load balancing
B.Scheduled backups
C.RAID 1 mirroring
D.Server clustering
AnswerD

Server clustering ties multiple servers together to act as a single system; if one node fails, another takes over automatically, providing high availability with minimal administrative effort.

Why this answer

Server clustering provides automatic failover between nodes, ensuring high availability with minimal administrative overhead. RAID 1 offers disk redundancy but not server-level failover. Load balancing distributes traffic but does not automatically redirect if a server fails.

Scheduled backups restore data after a failure but do not prevent downtime.

Full explanation →
55
PBQhard

A medium-sized company uses a backup strategy that includes a full backup every Sunday at 2:00 AM and differential backups Monday through Saturday at 2:00 AM. The backups are written to a network-attached storage (NAS) device. On Thursday morning, the company experiences a ransomware attack that encrypts all data on the file server, including the NAS. The administrator needs to restore the file server with minimal data loss. The last successful full backup was from the previous Sunday, and differential backups were successful on Monday, Tuesday, and Wednesday. However, Thursday's differential was not completed because the attack occurred before the scheduled time. The administrator attempts to restore using the Sunday full backup and Thursday's differential, but the restore fails because the differential backup on the NAS is also encrypted. Which of the following is the best course of action?

A.Pay the ransom to decrypt the differential backup
B.Restore from the Sunday full backup and Wednesday's differential backup
C.Reinstall the operating system and restore files from cloud storage
D.Restore using only Wednesday's differential backup
AnswerB

Why this answer

The most recent clean backup set is Sunday's full plus Wednesday's differential, as both were taken before the ransomware attack. Restoring from these will recover data as of Wednesday's backup, minimizing data loss. Using only Wednesday's differential requires the full backup first.

Paying the ransom is not recommended and may not work. Reinstalling the OS and restoring from cloud would not apply because cloud was not mentioned.

Full explanation →
56
PBQmedium

A server administrator receives reports that a production server is shutting down unexpectedly after running for several hours. The server is a 2U rackmount unit located in a data center with proper ambient cooling (20°C/68°F). The server has redundant power supplies connected to separate PDUs and no power anomalies are reported. The administrator checks the operating system event logs and finds a critical log entry: 'The system was shut down due to a thermal event.' However, the CPU temperature logs show that the CPU was at 47°C at the time of shutdown, and the chassis inlet temperature was 23°C. The server's internal fans are running at high speed and are clearly audible. The administrator suspects a thermal issue but is unsure why the CPU is not showing high temperature. The server has a baseboard management controller (BMC) that monitors various sensors. Which of the following components should the administrator investigate FIRST to identify the likely cause of the shutdown?

A.Swap the redundant power supplies to rule out a failing PSU.
B.Inspect the voltage regulator module (VRM) temperatures and airflow around the motherboard.
C.Replace the CPU heatsink and reapply thermal paste.
D.Update the server firmware and BIOS to the latest version.
AnswerB

Why this answer

Option B is correct because voltage regulator modules (VRMs) can overheat and trigger a thermal shutdown via the BMC even when the CPU temperature is within normal limits. VRMs are often located in areas with restricted airflow and are critical to CPU power delivery. Option A is incorrect because CPU temperature is normal, so the heatsink is likely functioning.

Option C is incorrect because power supply faults would not generate a thermal event. Option D is a possible long-term fix for a firmware bug, but physical inspection of temperature-sensitive components should come first.

Full explanation →
57
MCQmedium

After installing additional RAM modules in a server, the BIOS displays only a portion of the installed memory. The modules are identical in speed and size but from different manufacturers. Which of the following is the BEST initial troubleshooting step?

A.Replace the motherboard.
B.Run memtest86 immediately.
C.Reseat all memory modules and ensure proper slot population.
D.Update the server BIOS firmware.
AnswerC

This addresses the most common cause of unrecognized memory: poor connections or incorrect order of slots.

Why this answer

Reseating memory and checking population order (Option C) are the first steps because improper seating or incorrect slot placement can cause the BIOS to not recognize all modules. Updating BIOS (Option A) might help if a compatibility issue exists, but physical inspection should come first. Replacing the motherboard (Option B) is too extreme.

Running memtest86 (Option D) is useful but should follow physical checks.

Full explanation →
58
MCQmedium

A server with a RAID 5 array of four disks reports a degraded logical drive. The technician replaces the failed disk and rebuilds the array. After the rebuild completes, the array is still degraded. Which of the following is the most likely cause?

A.The replacement disk is assigned a different drive letter in the OS
B.The RAID controller firmware is outdated
C.The replacement disk has a different rotational speed than the other disks
D.The replacement disk is missing a partition table
AnswerC

Many RAID controllers require all drives in an array to have matching specifications; a speed mismatch can cause the rebuild to fail or the drive to be rejected.

Why this answer

Option B is correct because if the replacement disk is of a different speed (e.g., 10k vs 15k), the RAID controller may not accept it or the rebuild may fail, leaving the array degraded. Option A is wrong because missing a partition would not cause the array to remain degraded after rebuild; the array is at a lower level. Option C is wrong because if the firmware were outdated, the controller would likely not recognize the drive at all.

Option D is wrong because the disk name in Windows would not affect the RAID status.

Full explanation →
59
MCQmedium

Refer to the exhibit. During boot, the server displays this error and shuts down. Which of the following is the most likely cause?

A.The CPU heatsink is not properly installed.
B.The CPU fan is not connected to the CPU_FAN header.
C.The BIOS fan profile is set to 'Silent' mode.
D.The CPU has failed.
AnswerB

The error message 'No fan detected' strongly indicates a physical disconnection. The system halts to prevent thermal damage.

Why this answer

The log explicitly states 'No fan detected', which directly points to a missing connection on the CPU_FAN header. The shutdown is a protective response.

Full explanation →
60
MCQmedium

Refer to the exhibit. What is the most likely cause of this error?

A.The boot order is set incorrectly
B.The hard drive data cable is loose
C.The boot sector is corrupted
D.The hard drive has failed
AnswerA

If the BIOS is set to boot from a non-bootable device (e.g., network or USB) before the hard drive, it will fail with this error. Correcting the boot order resolves it.

Why this answer

The error 'Boot device not found' with 'Hard Disk: (3F0)' indicates the BIOS cannot find a bootable device. The most common cause is an incorrect boot order, where the system is trying to boot from a non-bootable device before the hard drive. A corrupt boot sector would give a different error (e.g., 'Missing operating system').

A loose cable could cause the drive not to be detected at all, but often the system would show no hard drive in BIOS. A failed drive would typically be detected but unbootable.

Full explanation →
61
PBQhard

A corporation's backup strategy currently involves a weekly full backup every Saturday night and daily differential backups Monday through Friday. The company has a 5 TB dataset with a daily change rate of about 10%. The full backup takes 12 hours and runs into Monday morning, impacting production performance. The backup window is from 10 PM to 6 AM. The company requires faster backups that can complete within the window, and they also want an offsite copy of the backups for disaster recovery. The existing backup server has direct-attached disk storage and a tape library. The network bandwidth to the offsite location is limited to 100 Mbps. The administrator is evaluating changes to the backup methodology and infrastructure to meet these requirements. Which of the following solutions best addresses the speed and offsite requirements?

A.Upgrade the tape library to use multiple tape drives for parallel backups and rotate tapes offsite daily
B.Switch to synthetic full backups combined with incremental forever; store backups locally on disk
C.Implement a disk-to-disk-to-cloud solution using changed block tracking for daily incrementals and replication to the cloud
D.Continue weekly fulls but perform daily incremental backups instead of differentials; keep tapes on-site
AnswerC

Why this answer

Option D is correct because it uses changed block tracking to perform incremental backups quickly, stores them on disk (fast), and replicates to cloud, which achieves offsite copy despite limited bandwidth by sending only changed blocks. Option A is wrong because synthetic full backups still require reading all data to synthesize, and offsite copy is not addressed. Option B is wrong because multiple tape drives increase throughput but do not directly reduce the amount of data backed up daily, and offsite tape handling is manual.

Option C is wrong because daily differentials will still grow each day and may exceed the window, and offsite is not specified.

Full explanation →
62
MCQhard

A server configured with dual redundant power supplies unexpectedly shuts down when one power supply fails. Both power supplies are rated for the server's total load and were functioning before the failure. What is the MOST likely reason for the shutdown?

A.The power supplies were not hot‑swappable
B.The failed power supply had a higher wattage rating than the remaining one
C.The power supplies were from different manufacturers
D.Redundant mode was not configured in the server management settings
AnswerD

Many servers require explicit configuration to operate in true N+1 redundancy; otherwise the loss of one PSU can cause an overcurrent event.

Why this answer

If redundant mode is not enabled (Option B), the power supplies may operate in combined/load‑sharing mode, and failure of one can overload the other. Hot‑swap capability (A) allows replacement without shutdown but does not prevent an outage if the remaining PSU cannot handle the load. Wattage mismatch (C) is unlikely if both were working, and different vendors (D) do not normally cause shutdown if the PSUs are compatible.

Full explanation →
63
MCQmedium

A technician is troubleshooting a server that fails to boot. The server displays a 'Boot Device Not Found' error. The technician verifies that the hard drives are spinning and appear in the RAID controller's BIOS. What should the technician check next?

A.Boot order in BIOS
B.Operating system files
C.SATA cable connections
D.RAID array status
AnswerA

If the boot order is set to a non-bootable device or the wrong disk, the server will not find the boot device even though drives are present.

Why this answer

Option B is correct because boot order is a common cause of 'Boot Device Not Found' when drives are detected. Option A is wrong because if drives are spinning and detected, cables are likely fine. Option C is wrong because missing OS files typically produce a different error.

Option D is wrong because the array status is already verified as healthy.

Full explanation →
64
MCQmedium

Refer to the exhibit. An administrator is reviewing logs after a server experienced performance issues and unexpected shutdowns. Based on the log entries, which component is MOST likely failing?

A.RAID controller
B.RAM module
C.Hard disk drive
D.Power supply
AnswerC

Medium errors and failed sector reallocation are direct indicators of physical hard disk drive failure.

Why this answer

The log entries show multiple SCSI medium errors, unrecovered read errors, and auto-reallocation failures on device sda, which are classic signs of a failing hard disk drive (Option B). A RAID controller (A) would typically show different errors, RAM (C) would cause memory-related errors, and a power supply (D) would trigger power event logs.

Full explanation →
65
MCQhard

Refer to the exhibit. An administrator receives reports that a web application is returning HTTP 502 errors. The administrator examines the Nginx error log on the reverse proxy server and sees the following. Which of the following is MOST likely causing the errors?

A.The Nginx service is not running.
B.The upstream server at 10.0.1.25:8080 refuses connections.
C.The firewall on the reverse proxy is blocking port 80.
D.The client's DNS cannot resolve example.com.
AnswerB

'Connection refused' directly signals that the upstream server is not listening on that port or is actively rejecting connections.

Why this answer

Option A is correct because the error 'Connection refused' indicates the upstream server (10.0.1.25:8080) is not accepting connections, typically because the backend service is down or the port is closed. Option B is incorrect because if Nginx were not running, no such log entry would be generated. Option C is incorrect because the client's DNS resolution is not involved after Nginx has already attempted to contact the upstream IP.

Option D is incorrect because a firewall blocking outbound connections would cause a timeout, not a 'Connection refused' message.

Full explanation →
66
MCQhard

A server running a critical database application crashes and fails to boot with the error message 'Operating System not found.' The server is equipped with a hardware RAID 5 array consisting of three identical disks. A technician suspects a disk failure. What is the MOST likely cause of this error?

A.A single disk has experienced a complete failure.
B.The boot sector on the disk is corrupted.
C.The RAID controller firmware is corrupted.
D.Two or more disks have failed.
AnswerD

RAID 5 cannot survive a second disk failure; the array goes offline, making the OS inaccessible.

Why this answer

Option D is correct because RAID 5 can tolerate a single disk failure and continue operating in a degraded state. The 'Operating System not found' message indicates the RAID array is offline or the boot volume is inaccessible, which most commonly happens when two or more disks fail simultaneously, exceeding the redundancy of RAID 5. Option A would not cause this error; a single failure would allow the OS to boot.

Option C is less common and might produce different errors. Option B could happen but is normally a second-order effect.

Full explanation →
67
MCQhard

A company uses a two-node failover cluster for a critical application. The cluster nodes are located in the same data center, and the quorum configuration uses a file share witness on a separate server in the same data center. During a major power outage, both cluster nodes and the file share witness server lose power. What is the impact on cluster availability?

A.The cluster will automatically fail over to a third site because the witness server is unavailable.
B.The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.
C.The cluster will be offline until one of the nodes or the witness comes back online.
D.The cluster remains online because the nodes can communicate directly and form quorum without the witness.
AnswerC

With all three voting members down, there are zero votes, below the quorum majority. The cluster will not start until at least two members are available (e.g., both nodes, or one node and the witness).

Why this answer

In a two-node cluster with a file share witness, if both nodes and the witness are unavailable, the cluster cannot achieve quorum and will be offline. This is because the cluster requires a majority of votes to stay online. With only two nodes, the witness is needed to break ties.

Without any votes, the cluster fails.

Full explanation →
68
MCQeasy

A server administrator notices that a database server is responding slowly to queries. The CPU utilization is at 30%, memory at 40%, and disk latency is normal. Which of the following should the administrator check NEXT?

A.Network bandwidth utilization
B.Power supply status
C.Database index fragmentation
D.Operating system patch level
AnswerA

Correct. High network utilization can cause slow query responses, so checking bandwidth is a logical next step.

Why this answer

Network bandwidth utilization should be checked next because high network usage can cause slow responses even when CPU, memory, and disk are fine.

Full explanation →
69
PBQhard

A small business relies on a tower server that acts as a file and print server for 15 employees. The server has a single Intel Xeon E-2300 series processor, four 16GB DDR4 ECC RDIMMs installed in dual-channel configuration, and two 2TB 7200 RPM SATA hard drives in a hardware RAID 1 mirror. The power supply unit (PSU) is a 500W 80+ Bronze unit that is about four years old. Recently, the server has started experiencing random, intermittent crashes resulting in a blue screen, typically during periods of heavy disk I/O, such as when multiple users access large files. Event Viewer logs show occasional corrected memory errors (ECC events) but no uncorrected errors. The administrator runs MemTest86+ on all four DIMMs for multiple passes, and no errors are detected. The server room ambient temperature is normal, and all fans are operating. The crashes are becoming more frequent. Which of the following actions would MOST likely resolve the underlying issue?

A.Reseat all memory modules and clean the DIMM slots
B.Replace the hard drives with solid-state drives (SSDs)
C.Replace the motherboard, as the memory controller is likely failing
D.Upgrade the power supply to a higher wattage, 80+ Gold unit
AnswerD

Why this answer

Option B is correct. Intermittent crashes under heavy load, combined with ECC corrected errors but passing memory tests, can indicate a power supply that is failing or inadequate under peak load. A 500W PSU may be marginal, especially with aging capacitors, causing voltage drops that lead to memory and system instability.

Option A: Replacing the motherboard is premature, as no clear evidence points to a faulty memory controller. Option C: Reseating RAM may help if a connection issue, but given MemTest passes and errors are corrected, physical seating is less likely. Option D: Replacing HDDs with SSDs would reduce I/O load but does not address the likely power instability causing memory errors and crashes.

Full explanation →
70
MCQhard

A company is planning to deploy a new web application on multiple servers behind a load balancer. The application requires consistent session data across all servers for seamless user experience. Which of the following solutions would BEST meet this requirement?

A.Configure each web server to store sessions locally and use sticky sessions on the load balancer.
B.Use round-robin DNS to distribute traffic.
C.Store session data in a shared, high-performance in-memory data store like Redis.
D.Implement database session storage with synchronous replication between servers.
AnswerC

A centralized in-memory data store allows all web servers to access and modify session data quickly, providing seamless user experience and consistent state across the cluster.

Why this answer

Option B is correct because a shared in-memory data store like Redis provides low-latency access to session data for all servers, ensuring consistency and high availability. Option A is wrong because round-robin DNS does not handle session persistence. Option C is wrong because sticky sessions tie a user to one server; if that server fails, the session is lost and consistency is not maintained across servers.

Option D is wrong because synchronous database replication adds latency and complexity, making it less suitable for high-performance web applications.

Full explanation →
71
PBQhard

A medium-sized e-commerce company operates three critical servers: a web front-end, a database server, and a file server. Currently, a full backup of all servers is performed every Sunday starting at 11:00 PM and completes in about 6 hours. Differential backups run each weekday at 11:00 PM, taking roughly 2 hours. On a Wednesday at 10:00 AM, a ransomware attack encrypts all data on all servers. The IT team’s incident response plan requires restoration with an RPO of 4 hours and an RTO of 8 hours. The latest clean backup is Tuesday’s differential, resulting in approximately 10 hours of data loss. Future attacks could occur at any time. Management is willing to spend up to $200 per month to improve the backup strategy but cannot afford new hardware or a dedicated hot site. The team needs a solution that reduces both RPO and RTO within budget while maintaining simplicity for a small IT staff of two. Which of the following backup strategies should be implemented to best meet these requirements?

A.Switch to daily full backups to a local NAS, which takes 8 hours.
B.Adopt real-time replication to a hot site located offsite.
C.Continue the current strategy but increase the frequency of differential backups to every 4 hours.
D.Implement hourly incremental backups with daily full backups to a cloud backup service, costing $50/month.
AnswerD

Why this answer

B is correct. Hourly incremental backups with daily fulls to a cloud service gives a maximum data loss of about one hour (if failure right before an incremental), meeting the 4-hour RPO. Daily full backups ensure faster restoration since only the last full and up to a few incrementals need to be applied, likely achieving an 8-hour RTO.

The $50/month cost is within budget. Option A (daily full to NAS) extends the backup window to 8 hours and may not meet RPO if an attack occurs between backups. Option C (more frequent differentials) will cause backup times to grow, potentially exceeding the window, and still may have a 4-hour RPO gap if scheduled every 4 hours but an attack occurs after the last.

Option D is cost-prohibitive. Thus, B is feasible and effective.

Full explanation →
72
PBQmedium

An administrator is monitoring a server that has a hardware RAID 5 array consisting of four 2 TB disks. The RAID controller's management software reports that one disk has a status of 'Pred Fail' (predictive failure). The array also has a dedicated hot spare disk already installed and set up. The array is still fully functional with no data loss, but the 'Pred Fail' warning indicates the disk is likely to fail soon. The server is a production database server that cannot be taken offline except for scheduled maintenance windows, which are not until the following weekend. The administrator needs to ensure data integrity and avoid any risk of downtime or data loss while waiting for the replacement. Which immediate action should the administrator take?

A.Wait for the disk to completely fail so that the hot spare will automatically rebuild the array
B.Use the RAID management software to initiate a proactive replacement of the pred fail disk with the hot spare
C.Take a full backup immediately and then replace the disk during the next maintenance window
D.Remove the pred fail disk from the array to force the hot spare to rebuild, then re-add the disk later
AnswerB

Why this answer

Option A is correct because replacing the failing disk with the hot spare proactively prevents the array from becoming degraded or failing if another disk fails, ensuring continuous protection. Option B is wrong because waiting risks catastrophic failure if another disk fails before the spare activates. Option C is wrong because a full backup is not a substitute for immediate redundancy restoration.

Option D is wrong because removing the disk from the array manually would degrade it and risk data loss if another disk fails during the rebuild.

Full explanation →
73
MCQhard

A MySQL database server on Linux is experiencing high CPU utilization during peak business hours. Upon investigation, the administrator finds that the query cache hit ratio is below 20%, and the query_cache_size is set to 0. The server has 64 GB of RAM and the database workload is primarily read-heavy. Which of the following actions should the administrator take FIRST to improve performance?

A.Set query_cache_size to an appropriate value, such as 256M, and monitor.
B.Add more RAM to the server.
C.Rebuild all indexes on the database tables.
D.Enable the slow query log to identify inefficient queries.
AnswerA

Enabling and sizing the query cache for a read-heavy workload can dramatically increase cache hits and reduce CPU.

Why this answer

Option D is correct because the query cache is disabled (size 0). Enabling it and setting an appropriate size will increase cache hits and reduce CPU load. Option A adds RAM but does not address the misconfigured cache.

Option B identifies queries but does not directly fix the cache. Option C rebuilds indexes, which may not impact query caching.

Full explanation →
74
MCQmedium

A technician is troubleshooting a server that is experiencing high disk I/O wait times. The disk queue length is consistently above 10. Which of the following is the MOST likely cause?

A.Insufficient RAM
B.Disk fragmentation
C.Slow network link
D.Overloaded CPU
AnswerA

Correct. When RAM is low, the system uses the disk as virtual memory, increasing I/O wait and queue length.

Why this answer

Insufficient RAM can cause excessive paging to disk, leading to high disk I/O wait times and long queue lengths.

Full explanation →
75
MCQhard

A database server with 64 GB of RAM and RAID 5 storage is experiencing intermittent performance degradation. System monitoring shows constant 95% memory utilization, high disk queue length, and frequent page faults. The server is running a critical application that cannot be restarted during business hours. Which action will provide the BEST permanent resolution?

A.Replace the RAID 5 array with RAID 10
B.Move the page file to a dedicated SSD
C.Increase the size of the page file
D.Add more physical RAM
AnswerD

More RAM directly alleviates memory pressure, reduces page faults, and eliminates the need for excessive paging.

Why this answer

High memory utilization combined with frequent page faults indicates a memory bottleneck. Adding physical RAM eliminates the need for paging, permanently resolving the root cause. Increasing or moving the page file only mitigates the symptoms, while replacing RAID 5 with RAID 10 improves disk performance but does not address the underlying memory shortage.

Full explanation →

Page 1 of 3

Page 2

All pages

123

Practice SK0-005 by domain

Target a specific domain to shore up weak areas.

server-hardware-installation-managementserver-administrationsecurity-disaster-recoverytroubleshooting
See all domains with question counts →