Hard Difficulty Questions

Check the SAS cable connection

Why wrong: Incorrect. Since the drive is inserted in a hot-swap bay, cabling is internal and unlikely to be loose.

Reboot the server

Why wrong: Incorrect. Rebooting may not force a rebuild; the controller typically waits for a manual command.

Replace the drive with a different model

Why wrong: Incorrect. Using a different model could cause compatibility issues; the rebuild should work with the same model.

Disable DFSR and use robocopy with /MIR /COPYALL during the cutover window to copy all data

Why wrong: Robocopy copying 2 TB over the network will likely exceed the four-hour window and cause user disruption.

Perform a full backup of the old server and restore to the new server during the cutover window using Windows Backup

Why wrong: Full backup/restore of 2 TB over the network or locally will likely take longer than four hours, and may not preserve open file states.

Increase the DFSR staging quota and bandwidth throttling to accelerate initial replication

Why wrong: Tuning settings cannot make initial replication of 2 TB complete in four hours; the data volume is too large.

Use the RAID controller utility to set the new drive as a hot spare and then reboot

Why wrong: The new drive is not yet installed; setting as hot spare won't help if the missing drive is not detected.

Replace the missing drive with the new one and allow the RAID controller to automatically rebuild

Why wrong: This might be premature; the issue could be a loose connection, not a failed drive.

Rebuild the entire RAID array after backing up data from the surviving drives

Why wrong: This is excessive and risks data loss; a single drive issue can usually be resolved with less drastic measures.

Update the server's BIOS to the latest version

Why wrong: BIOS updates rarely address random reboots unless a known bug exists, and this should not be the first step.

Replace the power supply unit

Why wrong: A failing PSU might cause reboots, but the UPS report suggests stable power; other symptoms like log errors would appear.

Disable the automatic restart feature in System Properties

Why wrong: This would only prevent the server from rebooting after a crash, but the underlying issue would remain, leading to possible data corruption.

Restart the Windows Server 2022 server to apply any pending policy changes.

Why wrong: Restarting does not assign the missing 'Log on as a service' right; the right must be explicitly granted before the service can start.

Configure the application to use a dynamic port instead of the static port 8443.

Why wrong: The application is designed to use a static port; changing to a dynamic port would likely break client connectivity and is not a proper fix for the logon failure.

Reset the service account password and update the service configuration.

Why wrong: The password was already verified correct, so resetting it is unnecessary and would not fix the missing 'Log on as a service' right.

The hard drive on the file server has failed

Why wrong: Hard drive failure would cause hardware errors or I/O errors, not a missing catalog files error.

The backup software is not compatible with the current OS version

Why wrong: Incompatibility would typically cause an initial backup or restore failure, not a missing catalog error.

The full backup media is corrupted

Why wrong: Corrupted full backup media would likely produce a read error, not a missing catalog files error.

Replace the failed disk and restore from backup

Why wrong: Restoring from backup is time-consuming and should only be done if the rebuild fails; not the best practice.

Replace the failed disk and perform a manual rebuild from backup

Why wrong: Manual rebuild from backup is slower and riskier than automatic rebuild, and should only be done if automatic fails.

Delete the logical drive and recreate the array

Why wrong: This would cause data loss and is not necessary when a simple disk replacement can restore the array.

Pay the ransom to decrypt the differential backup

Why wrong: Paying the ransom is not a recommended security practice and may not result in decryption.

Reinstall the operating system and restore files from cloud storage

Why wrong: There is no indication that cloud storage is available, and this would not utilize existing backups.

Restore using only Wednesday's differential backup

Why wrong: Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.

Add a second disk to the RAID 5 array (convert to RAID 6).

Why wrong: Converting to RAID 6 would add parity overhead and not reduce latency; it might even increase it.

Increase the VM's memory allocation.

Why wrong: Memory allocation does not affect disk latency directly; this would not resolve a storage I/O bottleneck.

Change the virtual disk type from thin to thick.

Why wrong: Changing disk type affects space allocation, not I/O latency; the underlying storage device remains the same.

The UPS battery is depleted

Why wrong: The UPS battery status does not affect the server's ability to power on if utility power is present; the server powers on momentarily.

One of the power supplies has failed

Why wrong: A failed power supply would not allow the server to power on even briefly; it would remain off or show error LEDs.

The CMOS battery is dead

Why wrong: A dead CMOS battery would only reset BIOS settings and may cause a date/time error, not a failure to POST.

Encrypt all backup data at rest and in transit.

Why wrong: Encryption protects confidentiality but does not prevent destruction or modification of the backup data. Ransomware can encrypt already-encrypted files, making them unrecoverable.

Require multi-factor authentication for the backup service account.

Why wrong: MFA adds security but if the ransomware gains access through the account (e.g., via a compromised client), it can still encrypt backups. Immutable storage is needed.

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Why wrong: Air-gapping helps but is not foolproof; if the backup server is compromised during the window, ransomware can still spread. Immutability is a stronger safeguard.

The cluster will automatically fail over to a third site because the witness server is unavailable.

Why wrong: There is no third site; the witness is only a file share, not a failover target.

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Why wrong: Dynamic quorum can adjust votes, but if all nodes and the witness are down, there are no votes to adjust.

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Why wrong: A two-node cluster without a witness cannot achieve quorum if one node fails; if both nodes are down, neither can vote.

The new replacement drive is faulty.

Why wrong: If the new drive were faulty, the rebuild would likely have failed or shown errors.

The motherboard has a faulty PCIe slot for the RAID controller.

Why wrong: Faulty PCIe slot would cause the controller to disappear or cause I/O errors, not parity errors.

The RAID controller cache module has failed.

Why wrong: Cache failure would cause write errors or performance issues, not parity errors on a mirrored pair.

Disable hyper-threading on the host

Why wrong: Incorrect. Disabling hyper-threading reduces logical CPUs, which can increase ready time and degrade performance further.

Increase the number of vCPUs for the VM

Why wrong: Incorrect. Increasing vCPUs can worsen ready time because it leads to more contention for physical cores.

Migrate the VM to a different host

Why wrong: Incorrect. While migration might help temporarily, it does not address the root cause of over-provisioning on the host.

Corrupted file system

Why wrong: Incorrect. File system corruption would show event IDs like 55 or 26, not a controller error.

Loose data cable

Why wrong: Incorrect. While loose cables can cause errors, event ID 11 typically points to a controller-level issue rather than a cable connection.

Failed hard disk drive

Why wrong: Incorrect. A disk failure usually generates different event IDs (e.g., 7, 50), and the error points to the controller.

Move the server to a cooler location in the data center

Why wrong: The ambient temperature is within acceptable range, so moving the server would not significantly improve cooling.

Reinstall the CPU heat sink with more thermal paste

Why wrong: The thermal paste has already been replaced; adding more or reapplying is unlikely to resolve the issue.

Replace the power supply unit

Why wrong: The PSU fan is integrated, but the logs point to CPU temperature, not power supply failure. Replacing PSU would not address the root cause.

Disable ECC in the firmware to prevent the module from reporting errors.

Why wrong: Disabling ECC would mask the error but would still leave the faulty module in place, increasing the risk of data corruption.

Reseat the DIMM in slot B2 and run a memory diagnostic test.

Why wrong: Reseating may temporarily fix a poor connection, but ECC errors usually indicate a failing DIMM that should be replaced.

Increase the DRAM voltage slightly in the BIOS/UEFI to improve stability.

Why wrong: Overvolting can damage components and is not a standard remediation for ECC errors; besides, the modules are all identical and within spec.

Enable XMP profile in the BIOS to force all DIMMs to 2666 MT/s.

Why wrong: XMP (Extreme Memory Profile) is an overclocking feature typically unavailable or unsuitable for stable server operations with registered memory.

Clear the CMOS to reset the memory training data.

Why wrong: Clearing CMOS might trigger retraining but will not override the hardware limitation imposed by the 2133 MT/s DIMM.

Move the DIMM from A1 to A2 and the DIMM from A2 to A1.

Why wrong: Swapping slots does not eliminate the speed mismatch; the slowest DIMM still dictates the memory bus speed.

The power supplies were not hot‑swappable

Why wrong: Even non‑hot‑swappable PSUs should continue to power the server if the second unit fails; hot‑swap only means you can replace without shutting down.

The failed power supply had a higher wattage rating than the remaining one

Why wrong: If both had been running, a minor wattage difference typically does not cause immediate shutdown.

The power supplies were from different manufacturers

Why wrong: As long as the power supplies meet the same electrical and mechanical specifications, different vendors rarely cause such behavior.

Add additional case fans to improve airflow.

Why wrong: With fans already maximized, poor case airflow is unlikely if the chassis is clean. The immediate focus should be on the CPU-to-heatsink interface.

Replace the CPU fans with higher RPM models.

Why wrong: If existing fans are functional and dust is cleared, the issue is likely heat transfer, not airflow volume. Replacing fans is less likely to resolve the root cause.

Increase the fan speed thresholds in the BIOS.

Why wrong: Adjusting thresholds would only mask the problem by allowing higher temperatures before speeding up fans, but the CPU is already overheating at idle.