Hard Difficulty Questions

Pay the ransom to decrypt the differential backup

Why wrong: Paying the ransom is not a recommended security practice and may not result in decryption.

Reinstall the operating system and restore files from cloud storage

Why wrong: There is no indication that cloud storage is available, and this would not utilize existing backups.

Restore using only Wednesday's differential backup

Why wrong: Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.

Add additional case fans to improve airflow.

Why wrong: With fans already maximized, poor case airflow is unlikely if the chassis is clean. The immediate focus should be on the CPU-to-heatsink interface.

Replace the CPU fans with higher RPM models.

Why wrong: If existing fans are functional and dust is cleared, the issue is likely heat transfer, not airflow volume. Replacing fans is less likely to resolve the root cause.

Increase the fan speed thresholds in the BIOS.

Why wrong: Adjusting thresholds would only mask the problem by allowing higher temperatures before speeding up fans, but the CPU is already overheating at idle.

A DHCP server configured to provide an IP to the management interface.

Why wrong: While convenient, DHCP is not essential; a static IP can be assigned manually to the management interface.

An installed operating system on the server.

Why wrong: Out-of-band management functions independently of the server's OS; it can operate even when the server is off or the OS has failed.

Delete log files in /var/log.

Why wrong: While it frees space, it might not free enough, and removing logs hampers troubleshooting and auditing.

Resize /dev/sda1 to 30G.

Why wrong: Resizing requires unmounting or rebooting and is not a quick solution; also, the root partition may be LVM-based or not easily extended online.

Change the RAID level of /dev/sda.

Why wrong: RAID level changes are unrelated to free space management and could introduce additional I/O load or data loss risk.

Add more RAM to the server.

Why wrong: More RAM could help overall, but the immediate bottleneck is that the query cache is turned off, not insufficient memory.

Rebuild all indexes on the database tables.

Why wrong: Index maintenance may improve some queries but does not enable the query cache, which is the immediate issue.

Enable the slow query log to identify inefficient queries.

Why wrong: This is a diagnostic step, not a performance fix; the low cache hit ratio directly points to query_cache_size.

Server hardware specifications

Why wrong: While useful for procurement, hardware specs are not a fundamental component of a DRP; they are operational documentation.

Network topology diagram

Why wrong: Network diagrams assist in recovery but are considered supporting documentation, not a mandatory core element of the plan itself.

Replace the RAID 5 array with RAID 10

Why wrong: Although RAID 10 may improve disk throughput, the root issue is insufficient memory, not storage performance.

Move the page file to a dedicated SSD

Why wrong: Moving the page file can reduce disk contention but still relies on paging, which is far slower than physical RAM.

Increase the size of the page file

Why wrong: Increasing the page file only offers a temporary workaround and may worsen disk I/O; it does not resolve the memory shortage.

Add a memory reservation for the VM in ESXi.

Why wrong: Reservation guarantees memory but doesn't reveal the cause; it's a reactive measure better applied after understanding host memory consumption.

Analyze the database query cache hit ratio and slow query logs.

Why wrong: Query analysis is a database tuning step; the OOM error indicates a memory allocation problem at the OS level, not necessarily a query issue.

Increase the VM's RAM allocation to 32GB.

Why wrong: Increasing RAM may temporarily resolve the OOM errors but does not identify why the OOM occurred despite no workload increase; it may mask the underlying issue.

Reboot HostB to renegotiate the network configuration.

Why wrong: Rebooting is a disruptive last resort; the issue is likely a static VLAN misconfig that a reboot won't fix unless the host's switch configuration is corrected.

Restart the vCenter Server service on the vCenter appliance.

Why wrong: vCenter manages the cluster but host networking is configured on each host; restarting vCenter does not change switch or host VLAN settings.

vMotion all affected VMs from HostB to HostA to confirm they work on HostA.

Why wrong: This would confirm the VMs are functional, but it does not fix HostB's networking and may not be possible if HostB's VM network is down.

Upgrade the tape library to use multiple tape drives for parallel backups and rotate tapes offsite daily

Why wrong: Parallel drives can improve speed but do not reduce the daily data volume; offsiting tapes is manual and risky.

Switch to synthetic full backups combined with incremental forever; store backups locally on disk

Why wrong: Synthetic fulls can reduce backup time but still require a full pass of changed data; offsite copy is not addressed.

Continue weekly fulls but perform daily incremental backups instead of differentials; keep tapes on-site

Why wrong: Incrementals would be faster but the full backup still takes 12 hours and offsite requirement is not met.

The power supplies were not hot‑swappable

Why wrong: Even non‑hot‑swappable PSUs should continue to power the server if the second unit fails; hot‑swap only means you can replace without shutting down.

The failed power supply had a higher wattage rating than the remaining one

Why wrong: If both had been running, a minor wattage difference typically does not cause immediate shutdown.

The power supplies were from different manufacturers

Why wrong: As long as the power supplies meet the same electrical and mechanical specifications, different vendors rarely cause such behavior.

Reseat all memory modules and clean the DIMM slots

Why wrong: Reseating is a basic troubleshooting step, but multiple passes of MemTest86+ with no errors suggest the electrical connections are sound.

Replace the hard drives with solid-state drives (SSDs)

Why wrong: SSDs would improve I/O performance and reduce power draw slightly, but they would not correct the underlying power instability that is causing ECC memory errors.

Replace the motherboard, as the memory controller is likely failing

Why wrong: No evidence points to a motherboard memory controller failure; MemTest86+ passes, and corrected errors can be caused by power fluctuations.

The hard drive on the file server has failed

Why wrong: Hard drive failure would cause hardware errors or I/O errors, not a missing catalog files error.

The backup software is not compatible with the current OS version

Why wrong: Incompatibility would typically cause an initial backup or restore failure, not a missing catalog error.

The full backup media is corrupted

Why wrong: Corrupted full backup media would likely produce a read error, not a missing catalog files error.

Add a second disk to the RAID 5 array (convert to RAID 6).

Why wrong: Converting to RAID 6 would add parity overhead and not reduce latency; it might even increase it.

Increase the VM's memory allocation.

Why wrong: Memory allocation does not affect disk latency directly; this would not resolve a storage I/O bottleneck.

Change the virtual disk type from thin to thick.

Why wrong: Changing disk type affects space allocation, not I/O latency; the underlying storage device remains the same.

The cluster will automatically fail over to a third site because the witness server is unavailable.

Why wrong: There is no third site; the witness is only a file share, not a failover target.

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Why wrong: Dynamic quorum can adjust votes, but if all nodes and the witness are down, there are no votes to adjust.

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Why wrong: A two-node cluster without a witness cannot achieve quorum if one node fails; if both nodes are down, neither can vote.

Check the SAS cable connection

Why wrong: Incorrect. Since the drive is inserted in a hot-swap bay, cabling is internal and unlikely to be loose.

Reboot the server

Why wrong: Incorrect. Rebooting may not force a rebuild; the controller typically waits for a manual command.

Replace the drive with a different model

Why wrong: Incorrect. Using a different model could cause compatibility issues; the rebuild should work with the same model.

Replace the failed disk and restore from backup

Why wrong: Restoring from backup is time-consuming and should only be done if the rebuild fails; not the best practice.

Replace the failed disk and perform a manual rebuild from backup

Why wrong: Manual rebuild from backup is slower and riskier than automatic rebuild, and should only be done if automatic fails.

Delete the logical drive and recreate the array

Why wrong: This would cause data loss and is not necessary when a simple disk replacement can restore the array.

The new replacement drive is faulty.

Why wrong: If the new drive were faulty, the rebuild would likely have failed or shown errors.

The motherboard has a faulty PCIe slot for the RAID controller.

Why wrong: Faulty PCIe slot would cause the controller to disappear or cause I/O errors, not parity errors.

The RAID controller cache module has failed.

Why wrong: Cache failure would cause write errors or performance issues, not parity errors on a mirrored pair.

Move the server to a cooler location in the data center

Why wrong: The ambient temperature is within acceptable range, so moving the server would not significantly improve cooling.

Reinstall the CPU heat sink with more thermal paste

Why wrong: The thermal paste has already been replaced; adding more or reapplying is unlikely to resolve the issue.

Replace the power supply unit

Why wrong: The PSU fan is integrated, but the logs point to CPU temperature, not power supply failure. Replacing PSU would not address the root cause.

Full backup daily, differential backup every hour

Why wrong: Hourly differential backups include all changes since the last full, growing larger each hour and extending backup windows.

Full backup weekly, differential backup every hour

Why wrong: Combining weekly fulls with hourly differentials results in increasingly large differentials that consume excessive storage and time.

Full backup weekly, incremental backup every hour

Why wrong: A weekly full with hourly incrementals may force restoration of many incrementals, potentially exceeding the 4-hour RTO.