154 free CompTIA Server+ SK0-005 practice questions from the CertStash pack of 617, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 154 free here, all 617 in the pack, and each step includes the one before it.
Get all 617 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which of the following is typical of software licensing in the cloud?
Show answer and explanation
Correct answer: C. Subscription-based
Cloud computing environments typically utilize a subscription-based software licensing model, allowing organizations to pay recurring fees based on usage, time, or active users rather than buying perpetual licenses.
Why the other options are wrong
- A. Per-socket licensing is traditional on-premises licensing based on physical CPU sockets.
- B. Perpetual licensing involves a one-time upfront purchase for permanent software use, which is rare in cloud models.
- D. Site-based licensing covers an entire physical facility or campus rather than cloud deployment models.
Question 2
A server administrator wants to run a performance monitor for optimal system utilization. Which of the following metrics can the administrator use for monitoring? (Choose two.)
Show answer and explanation
Correct answer: A, E. Memory; CPU
CPU and memory utilization are primary system performance metrics monitored to measure resource load and ensure optimal system health and availability.
Why the other options are wrong
- B. Page file usage is secondary to system memory and monitored specifically for virtual memory paging rather than general core system utilization.
- C. Services monitoring tracks individual process states rather than hardware system utilization metrics.
- D. Application monitoring tracks software performance rather than baseline server system metrics.
- F. Heartbeat checks verify host uptime and availability rather than measuring system resource utilization levels.
Question 3
A user cannot save large files to a directory on a Linux server that was accepting smaller files a few minutes ago. Which of the following commands should a technician use to identify the issue?
Show answer and explanation
Correct answer: C. df -h
The df -h command displays disk space usage for file systems in a human-readable format, allowing technicians to quickly verify if the target directory's partition has run out of space.
Why the other options are wrong
- A. The pvdisplay command shows information about LVM physical volumes rather than available file system disk space.
- B. The mount command lists currently mounted file systems but does not report disk usage details or space capacity.
- D. The fdisk -l command displays partition table information rather than current disk space usage.
Question 4
Following a recent power outage, a server in the datacenter has been constantly going offline and losing its configuration. Users have been experiencing access issues while using the application on the server. The server technician notices the date and time are incorrect when the server is online. All other servers are working. Which of the following would MOST likely cause this issue? (Choose two.)
Show answer and explanation
Correct answer: A, B. The server has a faulty power supply; The server has a CMOS battery failure
A failed CMOS battery causes a server to lose its system clock and BIOS settings after losing external power, while a faulty power supply causes continuous server instability, random shutdowns, and going offline.
Why the other options are wrong
- C. OS updates manage software patches and security fixes, not hardware time retention and power stability.
- D. A malfunctioning LED panel affects visual status displays but does not cause power loss or date/time configuration reset.
- E. Lack of NTP configuration affects clock drift while online, but does not cause the server to repeatedly crash or go offline.
- F. Disabling the time synchronization service prevents clock syncing over the network, but does not cause hardware reboots or physical configuration loss.
Question 5
A company has implemented a requirement to encrypt all the hard drives on its servers as part of a data loss prevention strategy. Which of the following should the company also perform as a data loss prevention method?
Show answer and explanation
Correct answer: A. Encrypt all network traffic
Encrypting all network traffic protects data in transit, complementing full-disk drive encryption (data at rest) as part of a comprehensive data protection and data loss prevention strategy.
Why the other options are wrong
- B. MFA enforces user authentication access control rather than protecting data against interception or unauthorized export.
- C. Blocking encrypted USB drives does not prevent data loss as effectively as controlling overall media usage or encrypting network data paths.
- D. Port security restricts physical switch access based on MAC addresses, which prevents unauthorized network connection rather than data loss from servers.
Question 6
A systems administrator is setting up a server on a LAN that uses an address space that follows the RFC 1918 standard. Which of the following IP addresses should the administrator use to be in compliance with the standard?
Show answer and explanation
Correct answer: C. 172.16.19.241
The address 172.16.19.241 falls within the RFC 1918 private IP address range of 172.16.0.0 to 172.31.255.255.
Why the other options are wrong
- A. 11.251.196.241 is a public IP address located outside the RFC 1918 10.0.0.0/8 range.
- B. 171.245.198.241 is a public IP address outside the RFC 1918 172.16.0.0/12 range.
- D. 193.168.145.241 is a public IP address outside the RFC 1918 192.168.0.0/16 range.
Question 7
An administrator needs to perform bare-metal maintenance on a server in a remote datacenter. Which of the following should the administrator use to access the server's console?
Show answer and explanation
Correct answer: A. IP KVM
IP KVM (Keyboard, Video, Mouse over IP) provides out-of-band, hardware-level remote access to a server's console regardless of the operating system state, making it ideal for bare-metal maintenance.
Why the other options are wrong
- B. VNC relies on an operating system service and GUI environment, making it unsuitable for bare-metal administrative access.
- C. A crash cart requires physical presence in the remote datacenter rather than remote access.
- D. RDP requires a running Windows operating system and network stack, rendering it unavailable during bare-metal maintenance.
- E. SSH requires an operating system with network and SSH services running, so it cannot be used for bare-metal server access.
Question 8
A technician needs to provide a VM with high availability. Which of the following actions should the technician take to complete this task as efficiently as possible?
Show answer and explanation
Correct answer: B. Clone the original VM
Cloning a virtual machine creates an exact copy of the VM, which can then be deployed to another host or cluster node to achieve high availability and redundancy efficiently.
Why the other options are wrong
- A. Snapshots capture the VM's state at a point in time for recovery, but they do not provide high availability across redundant hardware.
- C. Converting to dynamic disks changes storage allocation mechanisms but does not offer high availability.
- D. Physical-to-virtual (P2V) conversion migrates a physical machine to a VM, which is not applicable since the source is already a VM.
Question 9
A server administrator receives a report that Ann, a new user, is unable to save a file to her home directory on a server. The administrator checks Ann's home directory permissions and discovers the following: dr-xr-xr-- /home/Ann Which of the following commands should the administrator use to resolve the issue without granting unnecessary permissions?
Show answer and explanation
Correct answer: D. chmod 754 /home/Ann
The user permissions were set to read and execute (r-x, or 5), preventing Ann from writing or saving files to her home directory. Changing permissions to 754 grants the owner read, write, and execute permissions (7) while maintaining the original group (5) and others (4) permissions without granting excessive access.
Why the other options are wrong
- A. chmod 777 grants full read, write, and execute permissions to everyone, which violates the principle of least privilege.
- B. chmod 666 grants read and write permissions to everyone but removes execute permissions needed to traverse directories.
- C. chmod 711 removes read permissions for group and others, unnecessarily restricting existing directory access.
Question 10
A technician is unable to access a server's package repository internally or externally. Which of the following are the MOST likely reasons? (Choose two.)
Show answer and explanation
Correct answer: C, D. The technician does not have sufficient privileges; The external firewall is blocking access
Lacking elevated privileges (such as root or sudo) prevents users from running package manager commands locally, while external firewalls blocking HTTP/HTTPS/repository ports prevent reaching external package repositories.
Why the other options are wrong
- A. An architecture mismatch causes installation failure for specific packages, but does not block overall connection to a repository.
- B. System time mismatch affects SSL/TLS validation during HTTPS connections, but is less directly linked to total repository access failure than network firewalls or privileges.
- E. An incorrect default gateway prevents reaching external subnets, but would not prevent access to internal repositories on the local subnet.
- F. A full log file can cause system log errors, but does not directly block network communication to package repositories.
What people say about the full SK0-005 pack 4.8 from 6
Question 11
Which of the following techniques can be configured on a server for network redundancy?
Show answer and explanation
Correct answer: D. Teaming
NIC Teaming combines multiple physical network interface cards into a single logical interface, providing network redundancy and failover if one link fails.
Why the other options are wrong
- A. Clustering provides system-level or service-level high availability across multiple servers, not network adapter redundancy on a single server.
- B. Virtualizing creates software-based virtual hardware environments rather than providing hardware-level network link redundancy.
- C. Cloning duplicates system images or virtual machines and does not provide network interface redundancy.
Question 12
Which of the following is the MOST secure method to access servers located in remote branch offices?
Show answer and explanation
Correct answer: A. Use an MFA out-of-band solution
An out-of-band Multi-Factor Authentication (MFA) solution ensures that remote management access requires verification through a separate communication channel, significantly enhancing security against unauthorized access and credential compromise.
Why the other options are wrong
- B. Telnet sends data and authentication credentials in plaintext, making it highly insecure for remote administration.
- C. A password complexity policy strengthens passwords but does not protect against credential theft or secure remote transmission.
- D. Role-based access policies define access permissions but do not provide secure authentication mechanisms for remote connectivity.
Question 13
Which of the following script types would MOST likely be used on a modern Windows server OS?
Show answer and explanation
Correct answer: D. PowerShell
PowerShell is the modern scripting language for Windows Server operating systems. Introduced by Microsoft as a replacement for batch scripting, PowerShell provides object-oriented scripting capabilities, access to .NET Framework, WMI, and deep system integration. It is the default and recommended scripting tool for modern Windows Server environments (2008 and later). Batch scripting is legacy technology. VBS (VBScript) is deprecated and no longer recommended. Bash is the Unix/Linux shell, not used on Windows Server.
Why the other options are wrong
- A. Batch scripting is legacy technology largely replaced by PowerShell on modern Windows servers.
- B. VBS (VBScript) is deprecated and no longer the recommended scripting method for modern Windows Server.
- C. Bash is the Unix/Linux shell environment and is not the standard scripting language for Windows Server OS.
Question 14
Which of the following licensing models is MOST appropriate for a data center that has a variable daily equipment count?
Show answer and explanation
Correct answer: A. Per site
Per-site licensing is most appropriate for variable daily equipment counts because the license covers all equipment at that location regardless of how many servers are active on any given day. Per-server, per-user, and per-core licensing would require adjustments as equipment counts fluctuate, creating billing complexity. Per-site licensing provides a fixed, predictable cost regardless of daily variations in active equipment.
Why the other options are wrong
- B. Per-server licensing requires counting active servers daily, creating administrative overhead with variable counts.
- C. Per-user licensing doesn't align with data center equipment licensing models.
- D. Per-core licensing would require recalculation every time equipment is added or removed.
Question 15
A technician is trying to reach abc.intranet.com but is unable to do so by name. The technician is able to reach it by IP address, though. Which of the following is MOST likely misconfigured?
Show answer and explanation
Correct answer: B. The DNS
The technician can reach the host by IP address but not by hostname, which is a classic indicator of DNS misconfiguration. The ability to reach by IP proves the network path is viable; the problem is purely with name-to-IP resolution, which is the function of DNS.
Why the other options are wrong
- A. VLAN misconfiguration would prevent reaching by either hostname or IP address.
- C. Subnet mask issues would prevent IP-based connectivity entirely, not just hostname resolution.
- D. Default gateway problems would prevent reaching any remote host via either hostname or IP address.
Question 16
Which of the following backup types only records changes to the data blocks on a virtual machine?
Show answer and explanation
Correct answer: C. Incremental
Incremental backups (including changed block tracking on VMs) only record the specific data blocks or files that have changed since the last backup operation.
Why the other options are wrong
- A. Differential backups record all data changes that occurred since the last full backup, increasing in size over time.
- B. A snapshot creates a point-in-time image of a virtual machine's disk state and memory rather than a traditional data block backup.
- D. A synthetic full backup constructs a complete full backup image by merging previous incremental backups with a full backup.
Question 17
A server administrator wants to ensure a storage array can survive the failure of two drives without the loss of data. Which of the following RAID levels should the administrator choose?
Show answer and explanation
Correct answer: D. 6
RAID 6 (D) uses dual parity, allowing the array to survive the failure of any two drives without data loss. This is the only RAID level that provides protection against two simultaneous drive failures. RAID 5 only protects against one drive failure, making RAID 6 the correct choice for this requirement.
Why the other options are wrong
- A. RAID 0 provides no redundancy and data loss occurs with any drive failure.
- B. RAID 1 (mirroring) only protects against one drive failure.
- C. RAID 5 uses single parity and can only survive one drive failure, not two.
Question 18
A server administrator is trying to determine the cause of a slowdown on a database server. Upon investigation, the administrator determines the issue is in the storage subsystem. Which of the following will MOST likely resolve this issue?
Show answer and explanation
Correct answer: A. Increasing IOPS by implementing flash storage
A slowdown in the storage subsystem is typically caused by insufficient Input/Output Operations Per Second (IOPS). Flash storage dramatically increases IOPS compared to mechanical drives, resolving the bottleneck. Deduplication reduces capacity but not performance issues, adding a single 4TB SATA disk doesn't address IOPS limitations, and FAT32 would actually degrade performance and isn't suitable for databases.
Why the other options are wrong
- B. Deduplication addresses storage capacity, not performance/IOPS issues
- C. Adding a single mechanical SATA drive doesn't resolve IOPS bottlenecks
- D. FAT32 is inappropriate for databases and would reduce performance, not improve it
Question 19
A company needs to increase the security controls on its servers. An administrator is implementing MFA on all servers using cost-effective techniques. Which of the following should the administrator use to satisfy the MFA requirement?
Show answer and explanation
Correct answer: B. Push notifications
Push notifications (B) are a cost-effective MFA method that leverage existing smartphones or devices users already own, requiring no additional hardware purchases. This provides a second authentication factor without the expense of biometric systems, smart cards, or physical tokens, making it the most economical solution for implementing MFA across all servers.
Why the other options are wrong
- A. Biometrics requires specialized hardware infrastructure, making it costly.
- C. Smart cards require issuance, management, and reader infrastructure on each server.
- D. Physical tokens (like RSA keys) require procurement and replacement management, increasing costs.
Question 20
A systems administrator is preparing to install two servers in a single rack. The administrator is concerned that having both servers in one rack will increase the chance of power issues due to the increased load. Which of the following should the administrator implement FIRST to address the issue?
Show answer and explanation
Correct answer: A. Separate circuits
Implementing separate electrical circuits prevents tripping a single circuit breaker when adding high-load equipment to a server rack.
Why the other options are wrong
- B. An uninterruptible power supply provides temporary backup power during outages but does not resolve circuit overload from overall power draw.
- C. Increasing PDU capacity does not protect the underlying utility circuit from overloading if both PDUs feed off the same circuit.
- D. Redundant power supplies protect against individual power supply unit failures but still draw power from the circuit.
Question 21
Which of the following DR testing scenarios is described as verbally walking through each step of the DR plan in the context of a meeting?
Show answer and explanation
Correct answer: D. Tabletop
A tabletop exercise is a disaster recovery testing method where stakeholders verbally walk through each step of the disaster recovery plan in a structured meeting environment to review roles and response procedures.
Why the other options are wrong
- A. Live failover involves actually transitioning production workloads to a secondary DR site in real time.
- B. Simulated failover runs recovery processes in an isolated environment to test systems without affecting production.
- C. Asynchronous refers to a data replication method, not a disaster recovery testing approach.
Question 22
A technician runs top on a dual-core server and notes the following conditions: top `"- 14:32:27, 364 days, 14 users load average 60.5 12.4 13.6 Which of the following actions should the administrator take?
Show answer and explanation
Correct answer: C. Identify the runaway process or processes
A load average of 60.5 on a dual-core server indicates severe system resource exhaustion, as a dual-core CPU can handle a sustained load average of 2.0 efficiently. The administrator should immediately identify the runaway process or processes using process inspection tools to terminate or re-prioritize them.
Why the other options are wrong
- A. Rebooting the server without investigation may temporarily clear the load but does not identify the root cause or prevent it from recurring.
- B. Waiting for a load average of 60.5 to drop on its own risks server crash or complete unresponsiveness.
- D. Asking users to log off is premature and ineffective if the load is caused by a system process or single runaway service.
Question 23
A user has been unable to authenticate to the company's external, web-based database after clicking a link in an email that required the user to change the account password. Which of the following steps should the company take next?
Show answer and explanation
Correct answer: A. Disable the user's account and inform the security team.
This scenario presents a potential phishing or credential compromise attack. A user was directed via email to change their password on an external system and subsequently cannot authenticate, suggesting their credentials may have been compromised or the link was malicious. The appropriate response is to disable the account immediately to prevent unauthorized access and involve the security team for investigation and incident response.
Why the other options are wrong
- B. Creating a new login without investigating the security incident leaves the account potentially compromised and does not address the underlying threat.
- C. Using the link again could expose the user to the same phishing or malicious website that caused the original problem.
- D. Simply resetting the password without disabling the account or investigating does not address the potential security breach or prevent unauthorized access.
Question 24
Which of the following describes a configuration in which both nodes of a redundant system respond to service requests whenever possible?
Show answer and explanation
Correct answer: C. Active-active
Active-active describes a redundant configuration where both nodes simultaneously handle service requests and process workload, maximizing resource utilization. This differs from active-passive where only one node serves requests while the other remains on standby. Failover (B) and failback (D) are processes, not configurations describing how nodes respond to requests.
Why the other options are wrong
- A. Active-passive has only one node responding to requests at a time.
- B. Failover is a process of switching to a backup node, not a configuration state.
- D. Failback is the process of returning to the original node after failover, not a response configuration.
Question 25
A systems administrator is performing maintenance on 12 Windows servers that are in different racks at a large datacenter. Which of the following would allow the administrator to perform maintenance on all 12 servers without having to physically be at each server? (Choose two.)
Show answer and explanation
Correct answer: A, B. Remote desktop; IP KVM
Remote Desktop (RDP) and IP-based KVM switches allow system administrators to connect to and manage servers remotely across a datacenter network without requiring physical presence at each rack.
Why the other options are wrong
- C. A console connection requires a physical cable directly connected to the server's serial or management port.
- D. A virtual administration console is not standard terminology for physical server remote management.
- E. Remote drive access provides file-level access rather than full remote console and administrative control.
- F. A crash cart requires physically rolling a monitor and keyboard setup to each individual server rack.
Question 26
A server administrator is connecting a new storage array to a server. The administrator has obtained multiple IP addresses for the array. Which of the following connection types is the server MOST likely using to connect to the array?
Show answer and explanation
Correct answer: D. iSCSI
iSCSI (Internet SCSI) is a network protocol that allows block-level data transfer over TCP/IP networks. When a storage array is assigned multiple IP addresses, this strongly indicates iSCSI configuration, as iSCSI uses standard network protocols and multiple IPs can be assigned for redundancy, load balancing, or multiple data paths. The other options are direct-attached storage protocols that do not use multiple IP addresses.
Why the other options are wrong
- A. eSATA is an external SATA interface that connects directly to a server port, not using IP addresses.
- B. USB connections are direct point-to-point connections that do not require multiple IP address assignments.
- C. Fibre Channel uses dedicated fiber or converged networks, not standard IP addresses in the same manner as iSCSI.
Question 27
A systems administrator has noticed performance degradation on a company file server, and one of the disks on it has a solid amber light. The administrator logs on to the disk utility and sees the array is rebuilding. Which of the following should the administrator do NEXT once the rebuild is finished?
Show answer and explanation
Correct answer: C. Swap the drive and initialize the disk.
When an automatic rebuild onto a hot spare completes, the array returns to a healthy state, but the physical drive that failed (indicated by the solid amber light) still needs to be replaced with a new drive and initialized for future use.
Why the other options are wrong
- A. Restoring from a snapshot is unnecessary because the RAID array successfully rebuilt and preserved the data.
- B. Restoring from backup is not required since the RAID fault tolerance successfully restored redundancy via the rebuild process.
- D. Initializing the entire array would destroy all existing array data and configurations, which is unnecessary and destructive.
Question 28
A Linux server was recently updated. Now, the server stops during the boot process with a blank screen and an fs> prompt. Which of the following is the MOST likely cause of this issue?
Show answer and explanation
Correct answer: B. The UEFI boot was interrupted by a missing Linux boot file.
An fs> prompt on an otherwise blank screen is the UEFI shell's filesystem prompt, which appears when firmware hands off to the EFI shell because it cannot locate or execute the expected EFI boot loader. After an update, the Linux boot files (such as the GRUB EFI binary or the EFI boot entry in the ESP) were removed, renamed, or their NVRAM entry invalidated, so the UEFI boot process was interrupted by the missing Linux boot file and dropped to the shell.
Why the other options are wrong
- A. Booting to a USB flash drive would launch that media's boot loader or installer, not stall at a UEFI filesystem prompt.
- C. If no bootable disk were detected at all, the firmware would post a "no boot device" message rather than provide a UEFI shell prompt.
- D. A firmware upgrade need would not be triggered by a routine OS update, and outdated firmware does not produce an fs> prompt.
Question 29
Which of the following, if properly configured, would prevent a user from installing an OS on a server? (Choose two.)
Show answer and explanation
Correct answer: E, F. Bootloader password; BIOS/UEFI password
A bootloader password and BIOS/UEFI password both prevent unauthorized OS installation by controlling access before the operating system loads. The bootloader password requires authentication before the kernel boots, while BIOS/UEFI password control pre-boot settings and boot order. Both are effective at preventing OS installation attempts.
Why the other options are wrong
- A. Administrator password only controls access within an already-running OS, not pre-boot installation.
- B. Group Policy Objects are OS-level controls that cannot prevent installation at the pre-boot stage.
- C. Root password is a Linux OS-level credential that does not prevent OS installation from boot media.
- D. SELinux is an OS security module that cannot prevent installation from occurring at the pre-boot stage.
Question 30
Which of the following concepts refers to prioritizing a connection that had previously worked successfully?
Show answer and explanation
Correct answer: C. MRU
MRU (Most Recently Used) refers to prioritizing or preferring a connection, device, or resource that was previously used successfully. This concept is applied when a system maintains a list of connections and automatically attempts to connect to the most recently successful one first before trying other options.
Why the other options are wrong
- A. Round robin is a load-balancing algorithm that distributes connections equally across available options, not prioritizing a previous connection.
- B. SCP (Secure Copy Protocol) is a file transfer protocol and does not relate to connection prioritization concepts.
- D. Link aggregation combines multiple network links for increased bandwidth and redundancy, not for prioritizing previously successful connections.
Question 31
An administrator has been asked to disable CPU hyperthreading on a server to satisfy a licensing issue. Which of the following best describes how the administrator will likely perform this action?
Show answer and explanation
Correct answer: D. Use the BIOS/UEFI setup.
Hyperthreading is a CPU-level feature that must be enabled or disabled at the hardware level through the BIOS/UEFI setup before the operating system boots. This is not a setting that can be changed from within the operating system via RDP, scripts, or startup configuration files. The administrator must access the BIOS/UEFI menu during server boot to modify this setting.
Why the other options are wrong
- A. RDP/VNC sessions operate within the operating system and cannot access BIOS-level hardware settings.
- B. Startup configuration refers to OS-level boot settings, not hardware processor features.
- C. PowerShell/Bash scripts run within the operating system and cannot modify BIOS-level CPU settings.
Question 32
A technician has been asked to check on a SAN. Upon arrival, the technician notices the red LED indicator shows a disk has failed. Which of the following should the technician do NEXT, given the disk is hot swappable?
Show answer and explanation
Correct answer: B. Replace the disk
Hot-swappable drives are designed to be removed and replaced while the storage system remains powered on and operational, so replacing the failed disk directly is the correct next step.
Why the other options are wrong
- A. Stopping the volume share is unnecessary because hot-swappable arrays are built to maintain operational availability during disk replacement.
- C. Shutting down the SAN causes unnecessary downtime since hot-swappable drives do not require a power-down.
- D. Stopping all connections interrupts services and negates the benefit of hot-swappable hardware architecture.
Question 33
A technician is setting up a physical server that will be used to store sensitive data. The technician plans to set up the internal hard drives in a RAID 5 array for redundancy. Which of the following would be the BEST type of interface for the technician to use?
Show answer and explanation
Correct answer: A. SAS
Serial Attached SCSI (SAS) is an enterprise-grade interface that offers high performance, reliability, and dual-port capabilities suited for internal drive connections in server RAID arrays.
Why the other options are wrong
- B. USB is an external peripheral interface not suitable for high-performance internal RAID arrays.
- C. SD cards lack the performance, capacity, and enterprise reliability required for server RAID arrays.
- D. eSATA is designed for external SATA drive attachments, not internal server drive bays.
Question 34
Which of the following will correctly map a script to a home directory for a user based on username?
Show answer and explanation
Correct answer: B. \\server\%username%
The environment variable %username% dynamically resolves to the logged-in user's account name in Windows UNC path mappings.
Why the other options are wrong
- A. The trailing dollar sign ($) creates a hidden administrative share rather than dynamically inserting the user's account name.
- C. FirstInitialLastName is plain text and does not function as a variable to automatically substitute actual account names.
- D. $username$ uses incorrect variable syntax for Windows UNC path expansion.
Question 35
A server technician notices a server is very low on disk space. Upon inspecting the disk utilization, the technician discovers server logs are taking up a large amount of space. There is no central log server. Which of the following would help free up disk space?
Show answer and explanation
Correct answer: A. Log rotation
Log rotation automatically manages log files by archiving or deleting old logs after a specified period or size threshold, freeing up disk space. This is the best solution when there is no central log server, as it allows the local server to maintain its own logs efficiently without running out of disk space.
Why the other options are wrong
- B. Log shipping sends logs to a remote server but does not free up local disk space unless rotation is also implemented.
- C. Log alerting notifies administrators of issues but does not reduce disk usage.
- D. Log analysis examines log data for insights but does not address the disk space problem.
Question 36
An administrator has set up a GPO to disable USB drive access on a company’s servers. The GPO is set up as a computer configuration policy and does not use security groups filtering. The administrator is testing to ensure the policy is working correctly. A server in the accounting OU works as expected, but a server in the sales OU is still allowing access to USB drives. The administrator runs the gpupdate /force command and tries again; however, the server still allows access to the USB drive. Which of the following is the MOST likely cause?
Show answer and explanation
Correct answer: C. The scope is not configured properly.
The GPO is working on the accounting OU server but not on the sales OU server, despite both being computer configurations without security group filtering. This indicates the GPO is not linked to the sales OU or has an incorrect scope definition. The scope of a GPO determines which OUs it applies to. Since gpupdate /force doesn't resolve the issue, this is not a processing problem but rather a scope/linkage problem. The accounting server receives the policy because it's in an OU where the GPO is linked, while the sales server does not.
Why the other options are wrong
- A. WMI filters control conditional application of policies but wouldn't cause a policy to work in one OU and not another without affecting both equally.
- B. Item-level targeting applies to individual policy settings within a GPO, not to entire GPO scope across different OUs.
- D. Loopback processing affects how user policies are applied and wouldn't explain why a computer configuration policy fails in one OU while working in another.
Question 37
The management team at a healthcare organization is concerned about being able to access the daily vital records if there is an IT disaster that causes both servers and the network to be offline. Which of the following backup types can the organization use to mitigate this risk?
Show answer and explanation
Correct answer: D. Print
If an IT disaster takes down both the servers and the network, every electronic backup type depends on working IT equipment to be read. A printed copy of the daily vital records is the only option that can be read without servers or a network.
Why the other options are wrong
- A. Tape backups need a working server and tape drive to restore and read the data, which are offline in this scenario.
- B. Cloud backups are reached over the network, which is offline in this scenario.
- C. Disk backups need a working server or host to read them, which are offline in this scenario.
Question 38
When configuring networking on a VM, which of the following methods would allow multiple VMs to share the same host IP address?
Show answer and explanation
Correct answer: B. NAT
Network Address Translation (NAT) allows multiple virtual machines on a host to share the single IP address of the physical host for external network communication by translating private VM addresses.
Why the other options are wrong
- A. Bridged networking assigns each VM its own distinct IP address directly on the physical host network segment.
- C. Host-only networking restricts VMs to communicate only with each other and the host, preventing external access.
- D. A vSwitch is a virtual networking device that routes traffic, not an IP address sharing technique.
Question 39
A technician installed a kernel upgrade to a Linux server. The server now crashes regularly. Which of the following is the MOST likely cause?
Show answer and explanation
Correct answer: D. Some modules are not compatible.
After a kernel upgrade, regular server crashes most likely indicate incompatible kernel modules. The new kernel may be incompatible with drivers or modules for hardware components (network adapters, storage controllers, etc.) that were compiled for the previous kernel version. Module incompatibility directly causes kernel panics and crashes. Installing dependencies for multiple architectures would not cause crashes. Insufficient hard drive space would prevent the upgrade or cause specific disk-related errors, not regular crashes. A virus infection is unlikely to cause consistent crashes immediately after a kernel upgrade.
Why the other options are wrong
- A. Installing dependencies for multiple architectures does not cause kernel crashes; this is a configuration choice, not a crash cause.
- B. Hard drive space issues would cause specific I/O errors or installation failures, not regular system crashes after upgrade.
- C. A virus infection is unlikely to manifest immediately after a kernel upgrade and would be preceded by other warning signs.
Question 40
A technician is trying to determine the reason why a Linux server is not communicating on a network. The returned network configuration is as follows: eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 127.0.0.1 network 255.255.0.0 broadcast 127.0.0.1 Which of the following BEST describes what is happening?
Show answer and explanation
Correct answer: C. The server is configured to use DHCP on a network that does not have a DHCP server
When a Linux network interface set to DHCP cannot contact a DHCP server to obtain an IP address, it fails to acquire a valid network configuration and defaults or falls back improperly, resulting in missing or loopback configurations.
Why the other options are wrong
- A. Multiple scope options would not cause the network interface to lack a valid unicast network IP address.
- B. An incorrect subnet mask sent by DHCP would still assign a valid network IP address to the interface rather than leaving it unconfigured.
- D. An incorrect MTU setting affects packet fragmentation and throughput, not basic IP address acquisition.
Question 41
Users are experiencing issues when trying to access resources on multiple servers. The servers are virtual and run on an ESX server. A systems administrator is investigating but is unable to connect to any of the virtual servers. When the administrator connects to the host, a purple screen with white letters appears. Which of the following troubleshooting steps should the administrator perform FIRST?
Show answer and explanation
Correct answer: B. Review the log files.
A purple screen with white text on an ESX host is a critical error state (purple screen of death). The first troubleshooting step should be to review log files to identify the root cause of the failure. Log files will provide diagnostic information about what caused the ESX host to crash. Checking power supplies or reseating processors are hardware steps that should come after understanding the problem, and reinstalling is premature without diagnosis.
Why the other options are wrong
- A. Power supply checks should occur after reviewing logs to determine if the issue is actually hardware-related
- C. Reinstalling ESX server is a destructive step that should only occur after diagnosis and should not be the first step
- D. Reseating processors is a hardware troubleshooting step that should follow log analysis
Question 42
An administrator notices that a file server is filling up quickly but has many of the same files in different directories. Which of the following storage management techniques would resolve this issue?
Show answer and explanation
Correct answer: C. Deduplication
Deduplication eliminates duplicate copies of data by storing only one copy and using references or pointers for identical files. When many of the same files exist in different directories, deduplication directly solves this by reducing redundant storage. Provisioning allocates storage capacity, encryption secures data, and partitioning divides drives logically, none address the duplicate file problem.
Why the other options are wrong
- A. Provisioning allocates storage resources but doesn't reduce duplicate files.
- B. Encryption secures data but doesn't eliminate duplicate copies.
- D. Partitioning divides storage logically but doesn't remove redundant files.
Question 43
Which of the following BEST describes a disaster recovery site with a target storage array that receives replication traffic and servers that are only powered on in the event of a disaster?
Show answer and explanation
Correct answer: D. Warm
A warm site is a disaster recovery location that has some infrastructure and systems in place (such as a target storage array receiving replication traffic) but critical servers are not continuously powered on and operational until a disaster occurs. This matches the description perfectly: the storage array is actively receiving replication data to stay synchronized, but servers are only powered on when needed during an actual disaster. This provides a balance between readiness and cost, distinguishing it from cold sites (minimal infrastructure) and hot sites (fully operational and synchronized systems).
Why the other options are wrong
- A. Cloud is a deployment model, not a classification of disaster recovery site types based on readiness level.
- B. A cold site has minimal infrastructure and no active replication; it requires significant setup time after a disaster, not active storage replication.
- C. A hot site has fully operational, continuously powered systems and real-time replication, ready for immediate failover without startup delays.
Question 44
A server administrator is testing a disaster recovery plan. The test involves creating a downtime scenario and taking the necessary steps. Which of the following testing methods is the administrator MOST likely performing?
Show answer and explanation
Correct answer: B. Simulated
A simulated test involves creating a scenario-based downtime event where administrators execute recovery procedures in an isolated environment to validate the DR plan.
Why the other options are wrong
- A. Backup recovery tests specifically focus on restoring data files or systems from backup media rather than executing a downtime scenario plan.
- C. A tabletop exercise is a walk-through discussion of DR roles and procedures without executing practical steps.
- D. A live failover test switches actual production workloads to a secondary site, which impacts live systems directly.
Question 45
Which of the following would be BEST to help protect an organization against social engineering?
Show answer and explanation
Correct answer: B. Recurring training and support
Social engineering targets human vulnerabilities rather than technical controls. Recurring security awareness training and ongoing support are the most effective measures to help users recognize and report phishing and manipulative tactics.
Why the other options are wrong
- A. Complex passwords do not prevent users from accidentally revealing them to a social engineer.
- C. Single sign-on simplifies authentication access but does not educate users on how to recognize social engineering attacks.
- D. An updated code of conduct provides administrative policy guidelines but does not train employees on active threat detection.
Question 46
A server administrator is installing a new server in a data center. The administrator connects the server to a midplane but does not connect any cables. Which of the following types of servers is the administrator MOST likely installing?
Show answer and explanation
Correct answer: D. Blade
A blade server is a thin, modular server that connects to a midplane (a backplane that provides power, cooling, and connectivity) rather than requiring individual cable connections. The administrator's action of connecting to a midplane without external cables is the defining characteristic of blade server installation. Rack, tower, and virtual servers do not use midplanes in this manner.
Why the other options are wrong
- A. Rack servers require individual power and network cables to be connected directly.
- B. Virtual servers are software-based and do not have physical midplane connections.
- C. Tower servers are standalone units that require direct cable connections, not midplane connections.
Question 47
A server administrator is swapping out the GPU card inside a server. Which of the following actions should the administrator take FIRST?
Show answer and explanation
Correct answer: B. Ensure the GPU meets HCL guidelines.
Before purchasing or installing new hardware components like GPUs in a server, an administrator must first check the Hardware Compatibility List (HCL) to ensure system stability, vendor support, and proper physical/power compatibility.
Why the other options are wrong
- A. Physical inspection of the GPU should happen during installation, but confirming HCL compatibility must occur before attempting installation.
- C. Shutting down the server is an essential step during physical replacement, but confirming compatibility on the HCL must precede physical intervention.
- D. Disconnecting rack power is unnecessary and disruptive; shutting down the specific server and removing its power cords is sufficient.
Question 48
A systems administrator is trying to determine why users in the human resources department cannot access an application server. The administrator reviews the application logs but does not see any attempts by the users to access the application. Which of the following is preventing the users from accessing the application server?
Show answer and explanation
Correct answer: C. VLAN
If users cannot access the application server and there are no log entries showing access attempts, the traffic is being blocked before it reaches the application. A VLAN configuration issue would prevent the HR department's traffic from even reaching the application server, resulting in no logs. NAT would still allow traffic through with potential translation, ICMP is for ping/diagnostics, and NIDS is a detection tool that would show attempts in logs.
Why the other options are wrong
- A. NAT would translate addresses but not prevent access entirely without logs
- B. ICMP is used for diagnostics and wouldn't block application access
- D. NIDS would detect and log access attempts, which aren't appearing in logs
Question 49
A server technician is installing a Windows server OS on a physical server. The specifications for the installation call for a 4TB data volume. To ensure the partition is available to the OS, the technician must verify the:
Show answer and explanation
Correct answer: B. volume is formatted as GPT
GPT (GUID Partition Table) supports disk volumes larger than 2TB, whereas traditional MBR partition tables are limited to a maximum size of 2TB.
Why the other options are wrong
- A. UEFI compliance is necessary to boot an OS from a GPT disk larger than 2TB, but formatting a data-only volume as GPT does not strictly require UEFI firmware.
- C. MBR partition schemes do not support single partition sizes exceeding 2TB.
- D. Spanning across physical drives creates dynamic volumes but does not overcome the 2TB partition limit imposed by MBR.
Question 50
An administrator is alerted to a hardware failure in a mission-critical server. The alert states that two drives have failed. The administrator notes the drives are in different RAID 1 arrays, and both are hot-swappable. Which of the following steps will be the MOST efficient?
Show answer and explanation
Correct answer: C. Replace both failed drives at the same time.
When two drives in different RAID 1 arrays have both failed and are hot-swappable, replacing both drives simultaneously is the most efficient approach. Since they are in separate RAID 1 mirrors, replacing one drive while the other remains failed does not create additional risk of data loss. Replacing both at once minimizes downtime and gets the system back to full redundancy faster than waiting for one rebuild to complete before replacing the second drive. The server does not need to be shut down since the drives are hot-swappable.
Why the other options are wrong
- A. Replacing one drive and waiting for rebuild before replacing the second wastes time; since they're in different arrays, this sequential approach is unnecessarily slow.
- B. Shutting down the server is unnecessary for hot-swappable drives, which can be replaced while the system is running.
- D. Replacing all drives in both arrays is wasteful and unnecessary when only two specific drives have failed.
Question 51
A technician needs to set up a server backup method for some systems. The company's management team wants to have quick restores but minimize the amount of backup media required. Which of the following are the BEST backup methods to use to support the management's priorities? (Choose two.)
Show answer and explanation
Correct answer: A, B. Differential; Synthetic full
Differential backups require only the last full backup and the latest differential set to restore, enabling quick restores while requiring less overall storage media than daily full backups. Synthetic full backups synthesize incremental backups into a full backup image on the backup destination, eliminating heavy media storage consumption over the network while allowing rapid single-pass restores.
Why the other options are wrong
- C. Archive backups are long-term historical copies designed for compliance and storage retention rather than fast operational restores.
- D. Full backups require the most media storage space because all selected data is copied repeatedly during every backup job.
- E. Incremental backups minimize storage usage during backup windows but require restoring the last full backup plus every sequential incremental set, making restores slow.
- F. Open file options ensure locked or active files are backed up properly but do not affect restore speed or media capacity requirements.
Question 52
Which of the following backup types resets the archive bit each time it is run?
Show answer and explanation
Correct answer: C. Incremental
Incremental backups reset the archive bit each time they run, backing up only files that have changed since the last backup (files with the archive bit set). This allows incremental backups to capture only new or modified data, making them efficient in terms of storage and backup window. Differential and synthetic full backups do not reset the archive bit in the same manner.
Why the other options are wrong
- A. Differential backups reset the archive bit only after a full backup, not each time the differential runs.
- B. Snapshot backups are point-in-time copies and do not use the traditional archive bit mechanism.
- D. Synthetic full backups combine previous full and incremental backups without resetting the archive bit like an incremental backup does.
Question 53
A data center has 4U rack servers that need to be replaced using VMs but without losing any data. Which of the following methods will MOST likely be used to replace these servers?
Show answer and explanation
Correct answer: C. P2V
P2V (Physical-to-Virtual) conversion is the appropriate method to replace physical 4U rack servers with VMs while preserving all data and configurations. P2V tools migrate the entire physical server environment, OS, applications, data, and settings, directly into a virtual machine. This ensures no data loss and minimal downtime. VMFS is a file system, unattended scripted installation would require rebuilding, and VM cloning is used for duplicating existing VMs, not for converting physical servers.
Why the other options are wrong
- A. VMFS is a virtual machine file system used for storage, not a method for migrating physical servers.
- B. Unattended scripted OS installation would require manually rebuilding the server and its applications, risking data loss.
- D. VM cloning is used to duplicate existing virtual machines, not to convert physical servers into VMs.
Question 54
Users at a company work with highly sensitive data. The security department implemented an administrative and technical control to enforce least-privilege access assigned to files. However, the security department has discovered unauthorized data exfiltration. Which of the following is the BEST way to protect the data from leaking?
Show answer and explanation
Correct answer: C. Install a DLP solution.
Data Loss Prevention (DLP) solutions inspect network traffic and endpoint activities to detect and prevent sensitive data from being exfiltrated unauthorizedly.
Why the other options are wrong
- A. Privacy screens prevent shoulder surfing by nearby individuals but cannot stop digital transfer or leakage of sensitive data.
- B. Disk quotas limit storage usage on a volume but do not monitor or prevent file exfiltration.
- D. Locking screens protects unattended physical workstations from unauthorized local input, but does not monitor active data transfers.
Question 55
A company is implementing a check-in desk to heighten physical security. Which of the following access controls would be the most appropriate to facilitate this implementation?
Show answer and explanation
Correct answer: A. Security guards
Security guards at a check-in desk provide active, human-based access control that allows verification of credentials, authorization checking, and visitor management. Guards can make real-time decisions about access, log entries, and respond to security concerns, making them the most appropriate control for implementing a check-in desk system.
Why the other options are wrong
- B. Security cameras provide surveillance and recording but do not actively control or facilitate check-in access.
- C. Bollards are physical barriers that prevent vehicle access, not appropriate for a check-in desk.
- D. An access control vestibule is a physical architectural feature, not a facilitation method for check-in desk operations.
Question 56
A new Windows server has been introduced to the network. The server administrator is trying to connect remotely to the server but is unsuccessful. Basic troubleshooting shows the server is visible on the network. Which of the following should be configured on the server to be able to connect remotely? (Choose two.)
Show answer and explanation
Correct answer: A, E. Remote desktop connection; Port 3389
Remote Desktop Connection is the Windows service that must be enabled on the server to allow remote connections. Port 3389 is the default TCP port used by Remote Desktop Protocol (RDP) for remote desktop connections. Both must be configured, the service must be enabled and the appropriate port must be accessible.
Why the other options are wrong
- B. Remote Procedure Call is a general-purpose communication mechanism, not specifically for remote desktop access.
- C. Remote Assistance is for technical support assistance, not standard remote server administration.
- D. Port 443 is used for HTTPS/SSL, not for RDP connections.
- F. Port 5900 is used by VNC, not by Windows Remote Desktop Protocol.
Question 57
Which of the following is the MOST appropriate scripting language to use for a logon script for a Linux box?
Show answer and explanation
Correct answer: B. Shell
Shell scripting (such as Bash) is the native and most appropriate environment for creating login and startup scripts on Linux operating systems.
Why the other options are wrong
- A. VBScript is a legacy Windows scripting language and is not natively supported on Linux.
- C. Java is a compiled programming language rather than a lightweight native shell scripting language for Linux user logins.
- D. PowerShell is primarily designed for Windows environments, although cross-platform versions exist, it is not the standard choice for Linux logon scripts.
- E. Batch scripts (.bat/.cmd) are native to DOS and Windows Command Prompt, not Linux.
Question 58
A company’s servers are all displaying the wrong time. The server administrator confirms the time source is correct. Which of the following is MOST likely preventing the servers from obtaining the correct time?
Show answer and explanation
Correct answer: A. A firewall
If the time source is confirmed correct but servers cannot obtain the correct time, a firewall is most likely blocking NTP (Network Time Protocol) traffic on port 123 or preventing access to the time source server. Antivirus, HIDS, and user account control operate on individual systems and would not prevent time synchronization across multiple servers simultaneously.
Why the other options are wrong
- B. Antivirus operates locally and wouldn't block NTP time updates to multiple servers.
- C. HIDS (Host Intrusion Detection System) monitors for malicious activity but doesn't block NTP.
- D. User account control manages privilege elevation, not network time synchronization.
Question 59
A company wants to find an affordable way to simulate a fail over of a critical application. The company does not currently have a solution for it. The application consists of 15 servers, and the company would like to simulate on production configurations and IP address schemes. Which of the following would be the most cost-effective solution?
Show answer and explanation
Correct answer: E. Perform a tabletop fail over of the application.
A tabletop exercise is the most cost-effective way to simulate a failover. It allows the company to test procedures, identify gaps, and validate the failover plan using production configurations and IP schemes without requiring physical infrastructure investment. Building a warm site (A), cloud IaaS (B), hot site (C), or cold site (D) all require significant capital expenditure and ongoing costs. Since the company has no current failover solution, a tabletop exercise provides maximum value for minimum cost.
Why the other options are wrong
- A. A warm site requires building and maintaining redundant infrastructure at significant cost.
- B. Cloud IaaS requires ongoing licensing and infrastructure costs beyond budget constraints.
- C. A hot site is expensive, requiring fully operational redundant systems in real-time.
- D. A cold site still requires physical infrastructure investment and extended recovery time.
Question 60
An administrator notices high traffic on a certain subnet and would like to identify the source of the traffic. Which of the following tools should the administrator utilize?
Show answer and explanation
Correct answer: D. Sniffer
A sniffer (packet analyzer) captures and displays network traffic at the packet level, allowing an administrator to see the source and destination of traffic, protocols used, and data being transmitted. This tool is ideal for identifying which hosts are generating high traffic on a subnet.
Why the other options are wrong
- A. Anti-malware detects malicious software but doesn't identify traffic sources or provide network visibility.
- B. Nbtstat displays NetBIOS information and name table entries but doesn't capture live traffic or identify current traffic sources.
- C. A port scanner identifies open ports on hosts but doesn't show actual traffic flow or high-traffic sources.
Question 61
Which of the following technologies would allow an administrator to build a software RAID on a Windows server?
Show answer and explanation
Correct answer: B. Dynamic disk
Dynamic Disk is the Windows technology that enables software RAID creation. Dynamic disks support RAID 0, RAID 1, and RAID 5 configurations without requiring dedicated hardware. This is the standard Windows method for building software-based redundant storage solutions.
Why the other options are wrong
- A. Logical Volume Management is a Linux technology, not available natively on Windows.
- C. GPT (GUID Partition Table) is a partitioning scheme that does not provide RAID functionality.
- D. UEFI is a firmware specification that does not provide RAID capabilities; it is a boot mechanism.
Question 62
A Linux administrator created a script that will run at startup. After successfully writing the script, the administrator received the following output when trying to execute the script: hash: ./startUp.sh: Permission denied Which of the following commands would BEST resolve the error message?
Show answer and explanation
Correct answer: C. chmod +x startUp.sh
The error "Permission denied" indicates the script lacks execute permissions. The chmod +x command adds execute permission to the file, allowing it to run at startup. The +x flag grants execute permission to the file owner and others. chmod +w adds write permission (not needed); chmod 444 sets read-only permissions (removes all execute); chmod 466 sets read and write but not execute permission.
Why the other options are wrong
- A. chmod +w adds write permission but does not add the execute permission needed to run the script
- B. chmod 444 sets read-only permissions and removes execute permission, making the problem worse
- D. chmod 466 grants read and write permissions but does not include execute permission for any user
Question 63
Which of the following should be placed at the top of a Bash script to ensure it can be executed?
Show answer and explanation
Correct answer: C. #!
The shebang sequence (#!) placed at the very top of a script tells the operating system's program loader which interpreter program (such as /bin/bash) to use for executing the script.
Why the other options are wrong
- A. While 'bash' is the name of the shell program, it must be preceded by '#!' in a shebang line to automatically execute.
- B. !execute is not valid syntax for invoking an interpreter in Unix-like operating systems.
- D. @echo off is a command used in MS-DOS and Windows command batch files to suppress command repetition.
Question 64
Which of the following steps in the troubleshooting theory should be performed after a solution has been implemented? (Choose two.)
Show answer and explanation
Correct answer: A, C. Perform a root cause analysis; Document the findings
After a solution has been implemented and full system functionality is verified, the final steps in the standard troubleshooting methodology include performing a root cause analysis (to determine preventive measures) and documenting the findings, actions, and outcomes.
Why the other options are wrong
- B. Developing a plan of action must occur prior to implementing the solution.
- D. Escalation occurs during troubleshooting if the technician cannot resolve the issue, not after implementation.
- E. Scoping the issue is part of the initial problem identification phase.
- F. While user communication is important, standard troubleshooting framework emphasizes root cause analysis and documentation as official post-implementation steps.
Question 65
A server administrator needs to deploy five VMs, all of which must have the same type of configuration. Which of the following would be the MOST efficient way to perform this task?
Show answer and explanation
Correct answer: D. Use a VM template.
A virtual machine template is a standardized, pre-configured VM image used to quickly deploy multiple identical virtual machines efficiently.
Why the other options are wrong
- A. Snapshots capture point-in-time states of existing VMs for rollback purposes, not for cloning multiple new instances.
- B. Deploying directly onto physical hosts is inefficient and does not leverage virtualization cloning capabilities.
- C. P2V conversion converts a physical server into a virtual machine, which is not the standard or efficient way to deploy multiple identical new VMs.
Question 66
An administrator is troubleshooting a RAID issue in a failed server. The server reported a drive failure, and then it crashed and would no longer turn on. There are two arrays on the failed server: a two-drive RAID 0 set for the OS, and an eight-drive RAID 10 set for data. Which of the following failure scenarios MOST likely occurred?
Show answer and explanation
Correct answer: A. A drive failed in the OS array.
The OS array is RAID 0 (two drives), which has zero fault tolerance. A single drive failure in RAID 0 causes total array failure and system crash. The data array (RAID 10) can tolerate multiple drive failures. Since the system crashed after a single drive failure, it must have occurred in the OS array, not the data array.
Why the other options are wrong
- B. Drives do not recover in RAID arrays after failure; once failed, they require replacement.
- C. The data array in RAID 10 can tolerate drive failures without crashing the system.
- D. A single drive failure in RAID 10 would not crash the system; only the OS array failure causes immediate crash.
Question 67
Which of the following types of physical security controls would most likely be a target of a social engineering attack?
Show answer and explanation
Correct answer: A. A security guard
A security guard is a human element and the most likely target of social engineering attacks. Social engineers attempt to manipulate people through deception, impersonation, or psychological tactics to bypass security measures. While technical controls like bollards, fencing, and biometric locks resist direct attack, security guards can be deceived through pretexting, authority manipulation, or other social engineering techniques.
Why the other options are wrong
- B. An access control vestibule is a physical barrier that resists social engineering through its structural design.
- C. Perimeter fencing is a passive physical control that cannot be socially engineered in the traditional sense.
- D. Biometric locks require physical biological data that cannot be easily obtained through social engineering.
- E. Bollards are fixed physical barriers that prevent vehicle access and are not vulnerable to social engineering.
Question 68
Which of the following can be used to map a network drive to a user profile?
Show answer and explanation
Correct answer: C. Login script
Login scripts run automatically when a user logs into a workstation and are commonly configured to map shared network drives to specific drive letters in the user's profile.
Why the other options are wrong
- A. System services run background processes for the operating system and do not dynamically map user-specific session network drives.
- B. Network services manage network communication and protocols rather than executing user-level drive mapping commands during sign-in.
- D. Kickstart scripts are automated installation scripts used to deploy operating systems, not to map user network drives.
Question 69
A company is reviewing options for its current disaster recovery plan and potential changes to it. The security team will not allow customer data to egress to non-company equipment, and the company has requested recovery in the shortest possible time. Which of the following will BEST meet these goals?
Show answer and explanation
Correct answer: B. A hot site
A hot site is a fully configured operational facility owned or dedicated to the company that keeps hardware and data synchronized in real time, ensuring the shortest recovery time objective without sending data to third-party equipment.
Why the other options are wrong
- A. A warm site takes longer to operationalize than a hot site because equipment and data require setup time.
- C. Cloud recovery transfers company data to third-party vendor infrastructure, violating the security policy regarding non-company equipment.
- D. A cold site provides only space and basic infrastructure without hardware or data, resulting in the longest recovery time.
Question 70
A server administrator just installed a new physical server and needs to harden the OS. Which of the following best describes the OS hardening method?
Show answer and explanation
Correct answer: A. Apply security updates.
OS hardening refers to securing the operating system itself through configuration and patches. Applying security updates (A) is the primary and most critical OS hardening method as it addresses known vulnerabilities in the operating system. Disabling unneeded hardware (B) is physical hardening, setting a BIOS password (C) is BIOS-level security, and configuring boot order (D) is BIOS configuration, none are specifically OS hardening methods.
Why the other options are wrong
- B. Disabling hardware is physical/hardware hardening, not OS hardening.
- C. BIOS password protects BIOS settings, not the operating system itself.
- D. Boot order configuration is BIOS setup, not operating system hardening.
Question 71
An administrator needs to disable root login over SSH. Which of the following files should be edited to complete this task?
Show answer and explanation
Correct answer: B. /etc/ssh/sshd_config
The SSH server daemon configuration file is located at /etc/ssh/sshd_config. This is the system-wide configuration file for the SSH server and is the correct location to disable root login by setting 'PermitRootLogin no'. The sshd_config file controls the SSH server behavior.
Why the other options are wrong
- A. This path is incorrect; sshd_config is not located in the root user's .ssh directory.
- C. The ssh_config file is the client-side configuration, not the server-side configuration.
- D. The /etc/ssh/ssh_config is the client configuration file, not used for server settings.
Question 72
Which of the following licenses would MOST likely include vendor assistance?
Show answer and explanation
Correct answer: C. Subscription
Subscription licensing models bundle software rights with active vendor technical support, maintenance, and continuous updates for the duration of the subscription term.
Why the other options are wrong
- A. Open-source software generally relies on community support rather than guaranteed vendor assistance.
- B. Version compatibility ensures software works across versions but does not grant vendor support services.
- D. Maintenance and support is usually an add-on service contract rather than a software license type itself.
Question 73
A data center technician is assigned the daily task of walking through the data center to perform a health check on all the systems. Which of the following issues can the technician detect without logging on to any of the systems? (Choose two.)
Show answer and explanation
Correct answer: B, C. UPS battery fault; Overheating
During a physical walkthrough, a technician can visually detect a UPS battery fault via indicator lights or warning displays on the UPS unit, and can observe overheating through visual inspection of equipment, thermal imaging, or sensing hot exhaust. VLAN mismatch, memory exhaustion, IP conflicts, and OS failures are all logical/network issues that require logging into systems or monitoring tools to detect. These cannot be observed during a physical walkthrough without system access.
Why the other options are wrong
- A. VLAN mismatch is a network configuration issue that requires system access or network monitoring tools to detect.
- D. Memory exhaustion is a runtime OS metric that requires logging into the system to observe.
- E. IP conflicts require network diagnostics or system access to detect; they cannot be observed visually.
- F. OS failure cannot be diagnosed without accessing the system or observing behavioral symptoms that require login.
Question 74
An administrator discovers a Bash script file has the following permissions set in octal notation: 777 Which of the following is the MOST appropriate command to ensure only the root user can modify and execute the script?
Show answer and explanation
Correct answer: A. chmod go-rwx
The question asks to ensure only root can modify and execute the script. Starting from 777 (rwxrwxrwx for user, group, and other), the most direct command is 'chmod go-rwx' which removes all read, write, and execute permissions from group and other, leaving only root (user) with rwx permissions. Option B sets permissions but doesn't remove from others, C only adds to user, and D only removes from group.
Why the other options are wrong
- B. chmod u=rwx doesn't remove permissions from group and other users
- C. chmod u+wx only adds permissions to user and doesn't restrict group/other
- D. chmod g-rwx only removes from group, not from other users
Question 75
A technician has received multiple reports of issues with a server. The server occasionally has a BSOD, powers off unexpectedly, and has fans that run continuously. Which of the following BEST represents what the technician should investigate during troubleshooting?
Show answer and explanation
Correct answer: B. CPU overheating
When a server experiences continuous high fan speeds, unexpected power offs, and blue screens (BSODs), it indicates thermal throttling or thermal shutdown triggered by CPU overheating.
Why the other options are wrong
- A. Firmware incompatibility generally causes boot failures or device instability rather than continuous high fan speeds and thermal shutdowns.
- C. LED indicators are diagnostic tools to identify hardware status, not the root cause of the power offs and fan behavior.
- D. ESD damage typically causes permanent component failure or failure to POST rather than intermittent thermal symptoms.
Question 76
A server administrator is setting up a new payroll application. Compliance regulations require that all financial systems logs be stored in a central location. Which of the following should the administrator configure to ensure this requirement is met?
Show answer and explanation
Correct answer: C. Shipping
Log shipping (C) is the process of centrally collecting and transmitting logs from multiple sources to a central repository. This directly satisfies the compliance requirement to store all financial system logs in one centralized location. Shipping refers to the forwarding or transport of logs to the central location.
Why the other options are wrong
- A. Alerting notifies administrators of events but does not centralize log storage.
- B. Retention defines how long logs are kept but does not address centralized storage.
- D. Rotation manages log file sizes but does not send logs to a central location.
Question 77
The network's IDS is giving multiple alerts that unauthorized traffic from a critical application server is being sent to a known-bad public IP address. One of the alerts contains the following information: • Exploit Alert • Attempted User Privilege Gain 2/2/07-3:09:09 10.1.200.32 --> 208.206.12.9:80 This server application is part of a cluster in which two other servers are also servicing clients. The server administrator has verified the other servers are not sending out traffic to that public IP address. The IP address subnet of the application servers is 10.1.200.0/26. Which of the following should the administrator perform to ensure only authorized traffic is being sent from the application server and downtime is minimized? (Choose two.)
Show answer and explanation
Correct answer: B, C. Perform a vulnerability scan on all the servers within the cluster and patch accordingly; Block access to 208.206.12.9 from all servers on the network.
When an infected server is detected sending traffic to a known-bad IP, the immediate priorities are containment and investigation while maintaining service availability. Blocking the malicious destination (208.206.12.9) prevents further data exfiltration across the entire network, protecting other systems. Performing vulnerability scans and patches on all cluster servers addresses the root cause by identifying and remediating the compromise or vulnerability that allowed unauthorized traffic. These two actions work together: blocking prevents ongoing damage while vulnerability assessment and patching remediate the underlying issue. This approach minimizes downtime by keeping the server operational while addressing the threat.
Why the other options are wrong
- A. Disabling all services causes complete downtime to the critical application, violating the requirement to minimize downtime.
- D. Changing IP addresses does not address the security threat and could cause service disruption without solving the underlying problem.
- E. While antivirus deployment is helpful, weekly reboots are too infrequent for a critical security incident and GPO deployment takes time.
- F. Rebooting each server in the cluster causes unnecessary downtime; the immediate need is to block malicious traffic and scan for vulnerabilities without full restarts.
Question 78
Which of the following would MOST likely be part of the user authentication process when implementing SAML across multiple applications?
Show answer and explanation
Correct answer: A. SSO
Security Assertion Markup Language (SAML) is an open standard used for exchanging authentication and authorization data between an identity provider and a service provider, serving as the core protocol for Single Sign-On (SSO) across web applications.
Why the other options are wrong
- B. LDAP is a directory access protocol, whereas SAML is specifically used for federated web-based Single Sign-On.
- C. TACACS is a protocol used primarily for AAA administration on network devices, not application-level federated access.
- D. MFA provides an additional authentication factor but is not the overarching mechanism SAML provides for federated access across applications.
Question 79
A systems administrator recently upgraded the memory in a server, and now the server does not turn on, and nothing is displayed on the screen. Which of the following is the NEXT step the administrator should take to diagnose the error without opening the machine?
Show answer and explanation
Correct answer: B. Listen for POST code beeps.
POST (Power-On Self-Test) code beeps provide diagnostic information without opening the machine or logging in. Different beep patterns indicate specific hardware issues, and a one-beep-then-silence pattern after memory upgrade typically indicates a memory compatibility or seating issue. This is the next logical step before physically opening the machine or calling support. A cold reboot may not help if there's a hardware issue, checking monitor connection is less likely given the timing after memory upgrade, and checking for display output is already implied by the problem statement.
Why the other options are wrong
- A. A cold reboot will not resolve hardware seating or compatibility issues caused by improper memory installation.
- C. Technical support should only be called after performing basic diagnostics like listening for POST codes.
- D. Monitor connection issues are unlikely given the timing of the problem immediately after memory upgrade, and would not prevent the machine from turning on.
Question 80
A technician is troubleshooting a server issue. Which of the following should the technician do to ensure the solution can be duplicated in the future?
Show answer and explanation
Correct answer: B. Document the findings, actions, and outcomes throughout the process
Documenting findings, actions, and outcomes creates a referenceable record that enables technicians to reproduce the fix reliably if the issue occurs again.
Why the other options are wrong
- A. Verifying system functionality confirms the current problem is resolved but does not document the steps for future reference.
- C. Determining common elements helps isolate root causes during diagnosis but does not record the final solution.
- D. Notifying impacted users is part of change communication, not solution documentation.
Question 81
Which of the following asset management documents is used to identify the location of a server within a data center?
Show answer and explanation
Correct answer: C. Rack layout
A rack layout document specifically identifies the physical location and positioning of servers within data center racks and the data center facility structure. This is the standard asset management document used for locating hardware physically within a data center environment.
Why the other options are wrong
- A. An infrastructure diagram shows logical connections and network topology, not physical server locations.
- B. A workflow diagram describes processes and procedures, not hardware locations.
- D. A service manual provides technical specifications and repair information, not location details.
Question 82
A backup application is copying only changed files each time it runs. During a restore, however, only a single file is used. Which of the following backup methods does this describe?
Show answer and explanation
Correct answer: B. Synthetic full
A synthetic full backup runs incremental backups that capture only changed files, then uses metadata to construct a complete full backup image without re-backing up unchanged data. During restore, only this single synthesized full backup file is needed, making restoration efficient while maintaining changed-file-only backup operations.
Why the other options are wrong
- A. Open file backups allow backing up files in use, unrelated to this backup methodology.
- C. Full incremental is not a standard backup term; incremental backups require a full backup plus incrementals for restore.
- D. Full differential requires a full backup plus a single differential; this describes synthetic full.
Question 83
A very old PC is running a critical, proprietary application in MS-DOS. Administrators are concerned about the stability of this computer. Installation media has been lost, and the vendor is out of business. Which of the following would be the BEST course of action to preserve business continuity?
Show answer and explanation
Correct answer: B. Purchase matching hardware and clone the disk.
With the vendor out of business and installation media lost, cloning the disk to matching hardware provides the best insurance against total failure. If the original hardware fails, an identical system can be brought online immediately from the clone, ensuring business continuity for the proprietary application.
Why the other options are wrong
- A. Chkdsk tests don't prevent hardware failure or provide recovery capability.
- C. Upgrading to SSD risks incompatibility with the old DOS system or corrupting the legacy application.
- D. Quarterly backups alone don't help if you cannot reinstall the OS and application.
Question 84
A server administrator is connecting a Linux server to a storage array. The administrator wants to use a file-based storage protocol to store data on the server. Which of the following protocols will the administrator MOST likely use?
Show answer and explanation
Correct answer: A. NFS
NFS (Network File System) is a file-based storage protocol commonly used in Linux/Unix environments. It allows a server to access files over a network as if they were local, making it ideal for Linux servers connecting to storage arrays. NFS operates at the file level, allowing the administrator to store and access data files directly.
Why the other options are wrong
- B. FCoE (Fibre Channel over Ethernet) is a block-level storage protocol, not file-based.
- C. iSCSI is a block-level storage protocol that presents storage as block devices, not file-based access.
- D. CIFS (Common Internet File System) is primarily associated with Windows/SMB environments, not the typical choice for Linux servers.
Question 85
A server is only able to connect to a gigabit switch at 100Mb. Other devices are able to access the network port at full gigabit speeds, and when the server is brought to another location, it is able to connect at full gigabit speed. Which of the following should an administrator check first?
Show answer and explanation
Correct answer: C. The network cable
The most common cause of reduced network speed on a specific server is a faulty network cable. Since other devices on the same switch port operate at gigabit speeds and the server works at full speed elsewhere, the issue is isolated to the cable connecting this specific server to the switch. Cable damage, poor connections, or defective cables frequently cause speed negotiation to fall back to lower speeds like 100Mb.
Why the other options are wrong
- A. Switch management configuration would affect all devices on the switch equally, not just this one server.
- B. VLAN configuration issues would typically prevent connectivity entirely or affect multiple devices, not cause a specific speed limitation on one server.
- D. Network drivers would cause the same speed limitation when the server is moved to another location, but the server works at full gigabit speed elsewhere, ruling out driver issues.
Question 86
A server administrator is using remote access to update a server. The administrator notices numerous error messages when using YUM to update the applications on a server. Which of the following should the administrator check FIRST?
Show answer and explanation
Correct answer: C. Disk space in the /var directory
YUM downloads RPM packages and metadata to the /var/cache/yum directory and writes to /var/log/yum.log. If the /var partition runs out of disk space, YUM will throw various error messages during the update process, making disk space in /var the first thing to inspect.
Why the other options are wrong
- A. If network connectivity were lost, remote access to the server would not be working.
- B. Logical Volume Manager (LVM) status issues typically prevent mounting rather than causing specific application update errors.
- D. Checking dependencies comes later if package resolution fails, but disk space exhaustion in /var is the most common cause of sudden YUM errors.
Question 87
A server room with many racks of servers is managed remotely with occasional on-site support. Which of the following would be the MOST cost-effective option to administer and troubleshoot network problems locally on the servers?
Show answer and explanation
Correct answer: D. KVM
A KVM (Keyboard, Video, Mouse) switch is the most cost-effective solution for local administration and troubleshooting of multiple servers in a server room. It allows a single keyboard, monitor, and mouse to be physically switched between different servers, eliminating the need for dedicated peripherals for each server. While an IP KVM provides remote access capabilities (which may be less necessary given the scenario emphasizes 'occasional on-site support'), a standard KVM is more economical for local troubleshooting needs. Management ports and crash carts are either limited in scope or not practical for regular administration tasks.
Why the other options are wrong
- A. A management port provides only limited out-of-band access and cannot serve as a comprehensive local troubleshooting solution for all server issues.
- B. A crash cart (mobile workstation) is expensive and impractical for regular server administration when a simple KVM switch suffices.
- C. An IP KVM adds unnecessary cost through network infrastructure requirements when local, on-site troubleshooting can be handled more cost-effectively with a standard KVM.
Question 88
A technician wants to limit disk usage on a server. Which of the following should the technician implement?
Show answer and explanation
Correct answer: C. Disk quotas
Disk quotas allow system administrators to set limits on the amount of disk space individual users or applications can consume on a server volume.
Why the other options are wrong
- A. Formatting prepares a storage device with a file system, which wipes existing data rather than restricting ongoing disk space usage.
- B. Compression reduces the size of files stored on a disk but does not enforce a strict limit on user disk usage.
- D. Partitioning divides a physical disk into separate logical sections but does not directly limit individual user data consumption within those sections.
Question 89
A technician is attempting to update a server's firmware. After inserting the media for the firmware and restarting the server, the machine starts normally into the OS. Which of the following should the technician do NEXT to install the firmware?
Show answer and explanation
Correct answer: B. Boot from the media
If the server boots directly into the operating system after inserting bootable firmware media, the boot order must be adjusted or manually selected to force the server to boot from the installation media.
Why the other options are wrong
- A. Safe mode boots the operating system with minimal drivers, which does not boot off the external firmware update media.
- C. Host-based Intrusion Detection Systems (HIDS) monitor system activity and will not facilitate a firmware flash.
- D. Logging into the OS with administrator rights will not initiate offline firmware installation media if the server failed to boot from it.
Question 90
A junior administrator needs to configure a single RAID 5 volume out of four 200GB drives attached to the server using the maximum possible capacity. Upon completion, the server reports that all drives were used, and the approximate volume size is 400GB. Which of the following BEST describes the result of this configuration?
Show answer and explanation
Correct answer: D. RAID 10 was configured by mistake.
RAID 5 with four 200GB drives should yield approximately 600GB (one drive's worth is parity). The reported 400GB capacity indicates that two drives were used for parity, which is characteristic of RAID 10 (mirrored pairs). RAID 10 with four drives would indeed use 400GB of usable capacity (50% overhead for mirroring).
Why the other options are wrong
- A. RAID 0 with four 200GB drives would report 800GB, not 400GB.
- B. RAID 5 configured properly would show approximately 600GB capacity.
- C. JBOD (Just a Bunch of Disks) would report the full 800GB with no redundancy.
Question 91
A server that recently received hardware upgrades has begun to experience random BSOD conditions. Which of the following are likely causes of the issue? (Choose two.)
Show answer and explanation
Correct answer: A, C. Faulty memory; Incorrectly seated memory
Random Blue Screen of Death (BSOD) errors following a hardware upgrade are commonly caused by defective RAM (faulty memory) or improperly installed RAM modules (incorrectly seated memory).
Why the other options are wrong
- B. Data partition errors cause file access issues or disk check warnings rather than random system BSOD crashes.
- D. Incompatible disk speeds cause performance bottlenecks or bus negotiation fallback, not blue screen system crashes.
- E. An uninitialized disk simply appears as unallocated space and cannot be used until formatted, but it does not cause BSODs.
- F. Overallocated memory is a virtual machine memory management state, not a physical hardware upgrade issue causing host BSODs.
Question 92
Which of the following concepts is in use when dual power supplies are connected to different power sources?
Show answer and explanation
Correct answer: A. Fault tolerance
Fault tolerance (A) is the ability of a system to continue operating despite the failure of components. Dual power supplies connected to different power sources exemplify fault tolerance because if one power source fails, the other continues to provide power, ensuring uninterrupted operation. This is a classic example of redundancy providing fault tolerance.
Why the other options are wrong
- B. Active-passive describes a failover model but does not specifically describe dual power supplies.
- C. While related, component redundancy is broader; fault tolerance is the more specific concept.
- D. Heartbeat is a monitoring mechanism, not a power supply configuration concept.
- E. Link aggregation refers to network bandwidth, not power supply redundancy.
Question 93
An administrator is only able to log on to a server with a local account. The server has been successfully joined to the domain and can ping other servers by IP address. Which of the following locally defined settings is MOST likely misconfigured?
Show answer and explanation
Correct answer: C. DNS
The server is domain-joined and can reach other servers by IP address, meaning network connectivity and DHCP are working. However, the administrator cannot log in with domain accounts, only local accounts. This indicates the server cannot resolve domain names to locate domain controllers. DNS is required to resolve domain controller names (e.g., contoso.com) so the server can authenticate domain users. Without proper DNS configuration, the server cannot contact the domain controller for authentication, forcing reliance on local accounts only.
Why the other options are wrong
- A. DHCP provides IP addresses and is functioning since the server can ping by IP address.
- B. WINS is primarily for NetBIOS name resolution and is legacy; modern domain authentication relies on DNS.
- D. TCP is the transport protocol and is working since the server has network connectivity and can reach other servers.
Question 94
Which of the following is a type of replication in which all files are replicated, all of the time?
Show answer and explanation
Correct answer: A. Constant
Constant replication is the replication method where all files are replicated continuously and completely every time data changes. This ensures real-time synchronization with minimal data loss but requires significant bandwidth and resources. Application-consistent replication captures application-aware snapshots but not necessarily all files all the time. Synthetic full replication creates a full backup by combining a previous full backup with incremental changes rather than replicating all files directly. Full replication refers to a complete copy but not necessarily continuous.
Why the other options are wrong
- B. Application consistent replication focuses on application state at specific points in time, not continuous replication of all files.
- C. Synthetic full replication reconstructs a full copy from previous backups and increments, not by replicating all files all the time.
- D. Full replication describes a complete copy operation but does not specify that it occurs continuously with all changes.
Question 95
A server technician is configuring the IP address on a newly installed server. The documented configuration specifies using an IP address of 10.20.10.15 and a default gateway of 10.20.10.254. Which of the following subnet masks would be appropriate for this setup?
Show answer and explanation
Correct answer: A. 255.255.255.0
A subnet mask of 255.255.255.0 (/24) provides a single IP network range from 10.20.10.1 to 10.20.10.254. Both the host IP address 10.20.10.15 and the default gateway 10.20.10.254 fall within this same subnet broadcast domain, allowing communication between the server and gateway.
Why the other options are wrong
- B. A mask of 255.255.255.128 splits the octet into subnets 0-127 and 128-255, placing 10.20.10.15 and 10.20.10.254 on different subnets.
- C. A mask of 255.255.255.240 creates subnets of 16 addresses, placing 10.20.10.15 as a broadcast address and 10.20.10.254 in a separate subnet.
- D. A mask of 255.255.255.254 (/31) supports only two IP addresses in a point-to-point link and cannot accommodate both .15 and .254 together.
Question 96
Joe, a technician, wants to configure a server's networking information so he will no longer need to maintain a list of names and IP addresses in a file on the server. Which of the following will work BEST to accomplish this task?
Show answer and explanation
Correct answer: C. DNS
DNS (Domain Name System) allows automatic resolution of hostnames to IP addresses, eliminating the need to manually maintain a hosts file. DNS provides a centralized, scalable solution for name-to-address mapping across networks. DHCP assigns IP addresses but doesn't resolve names; a hosts file requires manual maintenance; VLANs are network segmentation and don't address the name resolution problem.
Why the other options are wrong
- A. DHCP assigns IP addresses dynamically but does not resolve hostnames to addresses
- B. A hosts file requires manual maintenance and defeats the purpose of avoiding manual IP/name lists
- D. VLANs provide network segmentation but do not resolve hostnames to IP addresses
Question 97
An administrator is helping to replicate a large amount of data between two Windows servers. The administrator is unsure how much data has already been transferred. Which of the following will BEST ensure all the data is copied consistently?
Show answer and explanation
Correct answer: D. robocopy
Robocopy (Robust File Copy) is a Windows utility specifically designed for large-scale data replication between servers. It provides detailed progress tracking, supports resuming interrupted copies, handles open files, and offers robust options for ensuring all data is copied consistently with verification capabilities.
Why the other options are wrong
- A. rsync is primarily a Unix/Linux tool and while capable, is not the best choice for Windows-to-Windows server replication.
- B. The copy command is basic and lacks the advanced tracking and recovery features needed for large data transfers.
- C. scp (Secure Copy) is used for secure file transfers over SSH, not optimized for large data replication between servers.
Question 98
A server shut down after an extended power outage. When power was restored, the system failed to start. A few seconds into booting, the Num Lock, Scroll Lock, and Caps Lock LEDs flashed several times, and the system stopped. Which of the following is the MOST likely cause of the issue?
Show answer and explanation
Correct answer: B. The system failed before the display card initialized.
During early POST, diagnostic flashing of keyboard LEDs (Num Lock, Scroll Lock, Caps Lock) indicates a system diagnostic code generated before the video display adapter is initialized.
Why the other options are wrong
- A. Flashing keyboard LEDs during boot are controlled by the motherboard firmware as diagnostic POST indicators, not an indicator of a bad keyboard.
- C. A faulty power supply typically causes a complete loss of power or failure to light LEDs rather than structured diagnostic LED flashing sequences.
- D. Network interface failures do not cause keyboard LED flashing during early system POST.
Question 99
Which of the following BEST describes a guarantee of the amount of time it will take to restore a downed service?
Show answer and explanation
Correct answer: A. RTO
RTO (Recovery Time Objective) is the maximum acceptable amount of time that a service can be down before it must be restored. It specifically defines the guarantee of how long restoration will take. While an SLA may contain RTO requirements, the RTO itself is the metric that directly describes the time guarantee for service restoration.
Why the other options are wrong
- B. An SLA is a broader agreement that may include RTO, but doesn't specifically guarantee restoration time.
- C. MTBF (Mean Time Between Failures) measures how long equipment operates between failures, not restoration time.
- D. MTTR (Mean Time To Repair) is an average historical metric, not a guaranteed maximum time objective.
Question 100
A technician is creating a network share that will be used across both Unix and Windows clients at the same time. Users need read and write access to the files. Which of the following would be BEST for the technician to deploy?
Show answer and explanation
Correct answer: B. CIFS
CIFS (Common Internet File System), also known as SMB, is the standard protocol for network file sharing that works seamlessly with both Windows and Unix/Linux clients. It provides native read and write access to shared files across different operating systems and is specifically designed for this cross-platform file sharing scenario.
Why the other options are wrong
- A. iSCSI is a block-level storage protocol used for SANs, not for general file sharing across different platforms.
- C. HTTPS is an encryption protocol for web communication, not a file sharing protocol.
- D. DAS (Direct Attached Storage) is local storage connected directly to a server, not a network sharing solution.
Question 101
An application server's power cord was accidentally unplugged. After plugging the cord back in, the server administrator notices some transactions were not written to the disk array. Which of the following is the MOST likely cause of this issue?
Show answer and explanation
Correct answer: D. Cache battery failure
Cache battery failure is the most likely cause. When a server loses power suddenly, any data cached in the disk array's write cache that hasn't been flushed to disk is lost. The cache battery is designed to preserve cached data during unexpected power loss by keeping the cache powered. A dead or failed cache battery means cached transactions cannot be written to disk after power loss, resulting in lost transactions. This directly explains why data was not written despite the server being restarted.
Why the other options are wrong
- A. Backplane failure would affect hardware communication but wouldn't specifically cause cached data loss during power loss.
- B. CMOS failure affects system boot settings and time, not disk cache operations.
- C. Misconfigured RAID might cause other issues but wouldn't explain why cached data specifically wasn't written after power restoration.
Question 102
A server is performing slowly, and users are reporting issues connecting to the application on that server. Upon investigation, the server administrator notices several unauthorized services running on that server that are successfully communicating to an external site. Which of the following are MOST likely causing the issue? (Choose two.)
Show answer and explanation
Correct answer: B, C. The firewall rule for the server is misconfigured; The server is infected with a virus
An unauthorized service communicating with an external site indicates that the server has been compromised by a virus or malware that installed malicious software. Furthermore, a misconfigured firewall rule allowed this unauthorized outbound traffic to succeed, which should have been blocked by strict network egress filtering rules.
Why the other options are wrong
- A. Adware on user devices would not cause unauthorized outbound network services to execute directly on the server.
- D. Intrusion detection monitors network traffic but does not cause server performance degradation or spawn unauthorized services.
- E. Disabling unnecessary services improves server security and performance rather than causing unauthorized external communication.
- F. SELinux is a mandatory access control security module that restricts unauthorized processes rather than enabling them.
Question 103
Which of the following BEST describes a security control that requires validating the user’s physical characteristics?
Show answer and explanation
Correct answer: B. Biometrics
Biometrics validates a user's identity based on unique physical characteristics such as fingerprints, facial recognition, iris scans, or voice patterns. These are inherent biological traits that cannot be easily duplicated or transferred, making biometrics a strong form of authentication based on physical characteristics.
Why the other options are wrong
- A. OTP (One-Time Password) is based on something you know/have (a temporal code), not physical characteristics.
- C. RFID is based on possession of a card or device, not physical characteristics of the user.
- D. Security cameras capture video footage for monitoring and audit purposes, not for validating user identity.
Question 104
A systems administrator is setting up a server farm for a new company. The company has a public range of IP addresses and uses the addresses internally. Which of the following IP addresses best fits this scenario?
Show answer and explanation
Correct answer: D. 216.176.128.10
The scenario describes a company with a public range of IP addresses that uses them internally. Only option D (216.176.128.10) is a publicly routable IP address that falls within the public address space. Options A and C are private address ranges (10.x.x.x and 192.168.x.x), and option B is the loopback address. Using a public IP range internally is allowed if the company owns that range.
Why the other options are wrong
- A. 10.3.7.27 is a private address in the 10.0.0.0/8 range, not a public address.
- B. 127.0.0.1 is the loopback address used only for local system communication, not internal company networking.
- C. 192.168.7.1 is a private address in the 192.168.0.0/16 range reserved for private use.
Question 105
Which of the following licensing models was created by software companies in response to the increasing density of processors?
Show answer and explanation
Correct answer: D. Per-core
Per-core licensing was created in response to increasing processor density. As multi-core processors became standard, companies like Microsoft and Oracle shifted from per-server licensing to per-core licensing to accurately reflect the computing power available, since a single physical server could now contain many cores. This addressed the pricing mismatch caused by hardware density increases.
Why the other options are wrong
- A. Per-instance licensing counts individual software installations, not processor density.
- B. Per-server licensing does not account for the increasing number of cores per server.
- C. Per-user licensing is based on user count, unrelated to processor density.
Question 106
An administrator is troubleshooting a failure in the datacenter in which a server shut down/powered off when utility power was lost. The server had redundant power supplies. Which of the following is the MOST likely cause of this failure?
Show answer and explanation
Correct answer: C. Both power supplies were connected to the same power feed
If both redundant power supplies are connected to the same power feed, a loss of power on that single feed deprives both supplies of power simultaneously, causing the server to shut down.
Why the other options are wrong
- A. Overcharged UPS batteries trigger alarm states or battery failure warnings rather than removing utility power redundant paths.
- B. Modern server power supplies feature auto-ranging capabilities and can operate on standard 110V-240V power.
- D. Power supplies connect to power sources like PDUs or utility lines, not cross-connected directly to each other.
Question 107
A server administrator made a change in a server’s BIOS in an attempt to fix an issue with the OS not turning on. However, the change did not successfully correct the issue. Which of the following should the server administrator do NEXT?
Show answer and explanation
Correct answer: C. Reverse the latest change made to the server and reboot.
Following proper troubleshooting methodology, after making a change that didn't solve the problem, the next step should be to reverse the change and verify the system returns to its previous state. This tests whether the BIOS change was the cause. Only after confirming the original state should other approaches be attempted. Reinstalling OS, flashing BIOS, or safe mode are more drastic steps that should come later if reverting doesn't help.
Why the other options are wrong
- A. Reinstalling OS is premature without first reverting the BIOS change
- B. Flashing BIOS is more drastic and should only occur after reverting the change
- D. Safe mode is for OS-level troubleshooting, not BIOS-related issues
Question 108
Users have noticed a server is performing below baseline expectations. While diagnosing the server, an administrator discovers disk drive performance has degraded. The administrator checks the diagnostics on the RAID controller and sees the battery on the controller has gone bad. Which of the following is causing the poor performance on the RAID array?
Show answer and explanation
Correct answer: A. The controller has disabled the write cache.
RAID controller batteries protect the write cache, allowing writes to be cached and later flushed to disk in optimal patterns. When the battery fails, the controller automatically disables the write cache to prevent data loss if power is lost, since cached data could not be protected. This significantly reduces write performance, causing the poor baseline performance observed. The other options don't directly result from a dead battery.
Why the other options are wrong
- B. A bad battery doesn't affect available channels on the controller.
- C. A dead battery doesn't cause array corruption; it only affects write cache behavior.
- D. Battery failure doesn't cause loss of controller configuration settings.
Question 109
A server administrator is exporting Windows system files before patching and saving them to the following location: \\server1\ITDept\ Which of the following is a storage protocol that the administrator is MOST likely using to save this data?
Show answer and explanation
Correct answer: C. CIFS
Universal Naming Convention (UNC) paths such as \\server1\ITDept\ represent network file shares, which in Windows environments primarily rely on SMB/CIFS (Common Internet File System).
Why the other options are wrong
- A. eSATA is a direct-attached storage interface for external drives rather than a network share protocol.
- B. FCoE provides block-level storage access over Ethernet rather than file-level UNC share access.
- D. SAS is a point-to-point interface used for local direct-attached block storage devices.
Question 110
Users at a company are licensed to use an application that is restricted by the number of active sessions. Which of the following best describes this licensing model?
Show answer and explanation
Correct answer: C. Per-concurrent user
Per-concurrent user licensing restricts the number of simultaneous active sessions that can be running at any given time. This matches the scenario where the application is restricted by the number of active sessions, regardless of how many users own licenses or which servers run the application.
Why the other options are wrong
- A. Per-server licensing charges per physical or virtual server instance, not per active session.
- B. Per-seat licensing charges per individual user, not per concurrent session.
- D. Per-core licensing charges based on processor cores, not active user sessions.
Question 111
A server administrator needs to keep a copy of an important fileshare that can be used to restore the share as quickly as possible. Which of the following is the BEST solution?
Show answer and explanation
Correct answer: D. Create a snapshot of the fileshare
Snapshots capture point-in-time states of a storage volume or fileshare rapidly, enabling fast recovery of files with minimal downtime compared to traditional backup restores.
Why the other options are wrong
- A. LTO-4 tape media requires sequential read operations, resulting in slow restoration speeds.
- B. Restoring from an incremental backup chain requires restoring the full backup plus every subsequent incremental, taking significantly more time.
- C. Manually copying files to another partition consumes excess disk space and lacks automated, rapid point-in-time recovery capabilities.
Question 112
A technician has received tickets reporting a server is responding slowly during business hours. Which of the following should the technician implement so the team will be informed of this behavior in real time?
Show answer and explanation
Correct answer: B. Alerts
Alerts are proactive notifications sent in real-time when monitored metrics fall outside acceptable thresholds, allowing the team to be informed immediately when performance issues occur. Alerts are designed for real-time incident notification. Log rotation (A) manages log file sizes. Reports (C) are historical summaries. Log shipping (D) transfers logs but doesn't provide real-time alerts.
Why the other options are wrong
- A. Log rotation manages log file storage, not real-time notifications.
- C. Reports are historical summaries, not real-time notifications.
- D. Log shipping transfers logs but does not generate real-time alerts about performance issues.
Question 113
A security technician generated a public/private key pair on a server. The technician needs to copy the key pair to another server on a different subnet. Which of the following is the MOST secure method to copy the keys?
Show answer and explanation
Correct answer: C. SCP
SCP (Secure Copy Protocol) is the most secure method for transferring sensitive files like cryptographic keys across networks. It uses SSH encryption to protect data in transit. HTTP is unencrypted, FTP sends credentials in plain text, and USB involves physical transfer which lacks encryption during network transmission (though it has physical security concerns).
Why the other options are wrong
- A. HTTP lacks encryption and is completely insecure for sensitive keys
- B. FTP transmits credentials and data in plain text without encryption
- D. USB lacks network encryption and requires physical transport, not network transfer
Question 114
A global organization keeps personnel application servers that are local to each country. However, a security audit shows these application servers are accessible from sites in other countries. Which of the following hardening techniques should the organization use to restrict access to only sites that are in the same country?
Show answer and explanation
Correct answer: A. Configure a firewall
Configuring a firewall with location- or IP-based traffic rules allows an organization to restrict access to local application servers so that only local network subnets can reach them.
Why the other options are wrong
- B. Closing unneeded ports blocks specific application protocols entirely rather than restricting access based on source IP address or geographical site.
- C. A Host-based Intrusion Detection System (HIDS) monitors host activities for malicious behavior but does not filter network access between international sites.
- D. Disabling unneeded services reduces local attack surface but does not restrict network traffic from foreign sites to valid running services.
Question 115
Users in an office lost access to a file server following a short power outage. The server administrator noticed the server was powered off. Which of the following should the administrator do to prevent this situation in the future?
Show answer and explanation
Correct answer: D. Connect the server to a UPS
A UPS (Uninterruptible Power Supply) provides battery backup power during brief electrical outages, keeping servers operational and preventing unexpected shutdowns.
Why the other options are wrong
- A. A KVM switch allows management of multiple servers from one console but provides no power backup capability.
- B. Cable management neatly organizes cables to improve airflow and prevent accidental unplugging, but cannot maintain power during an outage.
- C. Redundant network connections protect against network interface or switch failures, not power grid failures.
Question 116
A systems administrator has been alerted to a zero-day vulnerability that is impacting a service enabled on a server OS. Which of the following would work BEST to limit an attacker from exploiting this vulnerability?
Show answer and explanation
Correct answer: B. Closing open ports
A zero-day vulnerability has no official patch available yet. Closing open ports or disabling the vulnerable service immediately reduces the attack surface and prevents external exploitation.
Why the other options are wrong
- A. Patches are not yet available for zero-day vulnerabilities.
- C. Antivirus protection may not detect or prevent zero-day exploits targeting network services.
- D. A NIDS only detects intrusion attempts but does not actively block or prevent exploitation.
Question 117
Due to a recent application migration, a company's current storage solution does not meet the necessary requirements for hosting data without impacting performance when the data is accessed in real time by multiple users. Which of the following is the BEST solution for this issue?
Show answer and explanation
Correct answer: D. Deploy a new Fibre Channel SAN solution.
A Fibre Channel SAN (Storage Area Network) is specifically designed to provide high-performance, scalable storage for multiple concurrent users accessing data in real-time. It offers superior performance, reliability, and scalability compared to other solutions. After an application migration requiring better real-time performance for multiple users, a SAN is the enterprise-grade solution that directly addresses performance bottlenecks.
Why the other options are wrong
- A. Local external hard drives would not solve performance issues and create data fragmentation across multiple devices.
- B. Adding server memory helps with processing but does not address storage I/O performance for real-time multi-user access.
- C. Data compression reduces space but degrades performance due to compression/decompression overhead, worsening the stated problem.
Question 118
A change in policy requires a complete backup of the accounting server every seven days and a backup of modified data every day. Which of the following would be BEST to restore a full backup as quickly as possible in the event of a complete loss of server data?
Show answer and explanation
Correct answer: D. A full, weekly backup with daily differential backups
Differential backups capture all changes since the last full backup, making restoration fastest, requiring only the full backup plus the most recent differential. This meets the policy requirement (full weekly, daily modified data) while minimizing restore time in a complete data loss scenario.
Why the other options are wrong
- A. Open-file backups are for backing up files in use during work hours, not for ensuring complete recovery or meeting the backup frequency requirement.
- B. Archive backups mark files as backed up but don't track changes; they don't meet the daily modified data requirement effectively.
- C. Incremental backups require applying multiple daily increments in sequence, making restoration slower than differential backups which require only one increment.
Question 119
A security manager is concerned that a rogue employee could boot a server from an outside USB drive. Which of the following actions can be taken to reduce this risk? (Choose two.)
Show answer and explanation
Correct answer: B, C. Disable unneeded physical ports; Set a BIOS password.
To prevent booting from a USB drive, both disabling physical USB ports and setting a BIOS password are effective controls. Disabling USB ports (B) physically prevents USB devices from being used, while a BIOS password (C) prevents unauthorized changes to boot order settings. These directly address the threat of rogue employees booting from external media.
Why the other options are wrong
- A. Closing network ports does not prevent local USB boot attempts.
- D. SIEM monitors and logs events but does not prevent unauthorized booting.
- E. Disabling services does not prevent boot-level attacks from USB media.
- F. HIDS detects intrusions after they occur but cannot prevent USB booting.
Question 120
A technician noted the RAID hard drives were functional while troubleshooting a motherboard failure. The technician installed a spare motherboard with similar specifications and used the original components. Which of the following should the technician do to restore operations with minimal downtime?
Show answer and explanation
Correct answer: C. Reconfigure the RAID.
When a motherboard fails but RAID drives remain functional, the new motherboard typically has different RAID controller firmware or configuration. Reconfiguring the RAID allows the system to recognize the existing RAID array and restore it with minimal downtime. Reinstalling OS and programs would lose data and take longer, and installing from backup assumes a backup exists and is current.
Why the other options are wrong
- A. Reinstalling OS and programs causes significant downtime and data loss
- B. The drives are already RAID-configured; reconfiguration is needed not initial configuration
- D. Assumes backup exists and is current; doesn't address the immediate recovery of working RAID drives
Question 121
Two developers are working together on a project, and they have built out a set of shared servers that both developers can access over the internet. Which of the following cloud models is this an example of?
Show answer and explanation
Correct answer: D. Community
A community cloud is a cloud infrastructure shared by multiple organizations with common concerns, interests, or missions. In this scenario, two developers from what appears to be the same organization or collaborative group are sharing servers accessible over the internet, which fits the community cloud model. The key distinguishing factor is that this is shared infrastructure between a limited group of users (the two developers) rather than being open to the general public (which would be public cloud) or restricted to a single organization (which would be private cloud).
Why the other options are wrong
- A. Hybrid cloud combines multiple cloud models but there's no indication of on-premises infrastructure or mixed deployment here.
- B. Public cloud is available to the general public and typically accessed by many unknown users; this is restricted to two specific developers.
- C. Private cloud is dedicated to a single organization; the scenario involves multiple developers sharing resources, suggesting a community rather than private model.
Question 122
A technician has been tasked to install a new CPU. Prior to the installation, the server must be configured. Which of the following should the technician update?
Show answer and explanation
Correct answer: B. The BIOS
Before installing a new CPU in a server, the BIOS must be updated to recognize and properly support the new processor. The BIOS contains microcode that defines CPU compatibility, power settings, and boot parameters. Without a BIOS update, the server may fail to recognize the new CPU, fail to boot, or operate with incorrect settings. The RAID card, backplane, and HBA are unrelated to CPU installation and do not require configuration changes.
Why the other options are wrong
- A. The RAID card manages storage and is independent of CPU installation.
- C. The backplane is the passive infrastructure connecting hardware components and does not require updates for CPU changes.
- D. The HBA (Host Bus Adapter) manages SAN or external storage connections and is unrelated to CPU installation.
Question 123
After the installation of an additional network card into a server, the server will not boot into the OS. A technician tests the network card in a different server with a different OS and verifies the card functions correctly. Which of the following should the technician do NEXT to troubleshoot this issue?
Show answer and explanation
Correct answer: D. Verify the network card is on the HCL for the OS.
The next logical troubleshooting step is to verify that the network card is on the HCL (Hardware Compatibility List) for the OS (D). Since the card works in another server with a different OS, the issue is likely OS-specific compatibility. Confirming HCL compatibility determines if the card is officially supported before attempting other fixes.
Why the other options are wrong
- A. Removing the original card may resolve conflicts but doesn't diagnose the root cause.
- B. BIOS recognition would typically show the card present; this is less likely given the problem.
- C. RAM requirements for a network card are minimal; this is unlikely to cause boot failures.
Question 124
A server administrator needs to implement load balancing without purchasing any new hardware or implementing any new software. Which of the following will the administrator MOST likely implement?
Show answer and explanation
Correct answer: A. Round robin
Round robin is a load balancing algorithm that requires no additional hardware or software, it operates at the application or DNS level by distributing requests sequentially across available servers. This makes it the most practical choice for an administrator working without new hardware or software purchases.
Why the other options are wrong
- B. Link aggregation combines multiple network links but typically requires hardware support and doesn't balance application load.
- C. Most recently used is not a standard load balancing algorithm and doesn't distribute load effectively.
- D. Heartbeat is a clustering/monitoring tool used to detect server failures, not for load balancing itself.
Question 125
A server administrator purchased a single license key to use for all the new servers that will be imaged this year. Which of the following MOST likely refers to the licensing type that will be used?
Show answer and explanation
Correct answer: D. Volume
Volume licensing allows an organization to purchase a single license key (or set of keys) that can be deployed across multiple servers. This is ideal when an administrator wants to image multiple servers with one license during a deployment cycle. Per socket and per concurrent user require individual licensing for each unit, and open-source requires no license key.
Why the other options are wrong
- A. Per socket licensing requires separate licenses for each processor socket
- B. Open-source software doesn't use traditional license keys
- C. Per concurrent user licensing requires tracking and licensing per active user
Question 126
An administrator has been asked to deploy a database server that provides the highest performance with fault tolerance. Which of the following RAID levels will fulfill this request?
Show answer and explanation
Correct answer: E. RAID 10
RAID 10 (1+0, mirroring then striping) provides the best combination of high performance and fault tolerance. It offers excellent write performance from striping, excellent read performance, and can tolerate failure of one drive per mirror pair. RAID 0 has no fault tolerance, RAID 1 has lower performance than RAID 10, RAID 5 has degraded write performance due to parity calculations, and RAID 6 has even slower write performance. For database servers requiring maximum performance with reliability, RAID 10 is the industry standard choice.
Why the other options are wrong
- A. RAID 0 provides no fault tolerance; any single drive failure results in total data loss.
- B. RAID 1 provides fault tolerance but limited performance scaling and is not optimal for high-performance database servers.
- C. RAID 5 has slower write performance due to parity calculations and is not ideal for high-performance databases.
- D. RAID 6 provides excellent fault tolerance but write performance is further degraded compared to RAID 5.
Question 127
A technician is deploying a new workstation. The workstation uses DHCP and can ping other devices on the same VLAN, but it cannot access anything on a different VLAN. Which of the following steps should the technician perform NEXT?
Show answer and explanation
Correct answer: C. Examine the DHCP scope configuration.
If a workstation can communicate within its VLAN but not across VLANs, the issue is typically routing-related. The DHCP scope configuration should be checked to ensure the default gateway is correctly assigned, as the gateway is required for inter-VLAN communication. Without a proper default gateway in the DHCP scope, the workstation cannot route traffic to different VLANs.
Why the other options are wrong
- A. IPv6 enablement would not resolve VLAN routing issues on IPv4 networks
- B. A local hosts file is for hostname resolution, not VLAN routing problems
- D. APIPA is for link-local addressing when DHCP fails; it doesn't enable inter-VLAN routing
Question 128
A server is reporting a hard drive S.M.A.R.T. error. When a technician checks on the drive, however, it appears that all drives in the server are functioning normally. Which of the following is the reason for this issue?
Show answer and explanation
Correct answer: A. A S.M.A.R.T. error is a predictive failure notice. The drive will fail in the near future and should be replaced at the next earliest time possible
S.M.A.R.T. provides predictive failure warnings based on drive health telemetry, indicating that a drive is operating within degraded parameters and should be replaced before catastrophic failure occurs.
Why the other options are wrong
- B. S.M.A.R.T. does not handle real-time write operation retransmission requests.
- C. A S.M.A.R.T. alert signifies that drive thresholds have breached critical limits, not just isolated bad sector reallocations.
- D. ECC errors are corrected automatically at the hardware level and do not trigger a overall S.M.A.R.T. status failure alert on their own.
Question 129
A technician is setting up a small office that consists of five Windows 10 computers. The technician has been asked to use a simple IP configuration without manually adding any IP addresses. Which of the following will the technician MOST likely use for the IP address assignment?
Show answer and explanation
Correct answer: D. DHCP
DHCP (Dynamic Host Configuration Protocol) is the standard method for automatic IP address assignment in networks without manual configuration. When a technician needs to set up multiple computers with simple IP configuration and without manually assigning addresses, DHCP is the most likely solution. A DHCP server automatically assigns IP addresses, subnet masks, gateways, and DNS settings to clients, making it ideal for a small office environment where ease of deployment is required.
Why the other options are wrong
- A. Static IP addresses require manual configuration of each address, which contradicts the requirement for simple setup without manual address assignment.
- B. Router-assigned is not a standard IP configuration method; DHCP is the protocol through which routers assign addresses automatically.
- C. APIPA (Automatic Private IP Addressing) is a fallback mechanism that only assigns addresses when DHCP is unavailable, not a primary solution for intentional network setup.
Question 130
A technician has moved a data drive from a new Windows server to an older Windows server. The hardware recognizes the drive, but the data is not visible to the OS. Which of the following is the MOST likely cause of the issue?
Show answer and explanation
Correct answer: A. The disk uses GPT.
Newer Windows servers support GPT (GUID Partition Table) disks, while older Windows servers only recognize MBR (Master Boot Record) partitioned disks. When a GPT disk is moved to an older server, the OS cannot interpret the partition table and the data becomes inaccessible, even though the hardware detects the drive. Ext4 (B) and FAT32 (C) are file system formats that would still show some partition recognition. MBR (D) would be compatible with older servers.
Why the other options are wrong
- B. Ext4 is a Linux file system; while the older server might not recognize it natively, this is about partition table format, not file system.
- C. FAT32 is file system format that would be recognized; the issue is the partition table structure.
- D. MBR is the older standard that would be compatible with older Windows servers, not the cause of invisibility.
Question 131
Which of the following are measures that should be taken when a data breach occurs? (Choose two.)
Show answer and explanation
Correct answer: B, E. Disclose the incident; Identify the exploited vulnerability.
When a data breach occurs, the two critical measures are: (B) Disclose the incident, compliance regulations (GDPR, HIPAA, state laws) require notification of affected parties and authorities; and (E) Identify the exploited vulnerability, understanding how the breach occurred is essential for remediation and preventing recurrence. Restoring from backup should occur after the breach is secured and analyzed. Disabling ports and antivirus scans are defensive measures but not primary breach response steps. Moving data is not a standard breach response procedure.
Why the other options are wrong
- A. Restoring from backup should occur after identifying and securing the breach, not as an immediate response measure
- C. Disabling ports is a hardening measure but not a primary response step to an active breach
- D. Running antivirus scans is a security practice but not a primary breach response requirement
- F. Moving data to another location does not address the breach response and may complicate forensic investigation
Question 132
A technician recently applied a patch to a working server. After rebooting, the technician notices the server is unable to connect to a nearby database server. The technician validates a connection can be made to the database from another host. Which of the following is the best NEXT step to restore connectivity?
Show answer and explanation
Correct answer: D. Roll back the applied patch.
After a patch is applied and the server stops functioning, the most efficient next step to restore connectivity is to roll back the patch. Since the connectivity issue began immediately after patching, the patch is the most likely culprit. Rolling back is the fastest way to restore service while maintaining the existing configuration. Once service is restored, the administrator can investigate the specific patch issues and plan a more careful remediation. This is more direct than checking firewall rules or changing service accounts, which are not related to recent patch changes.
Why the other options are wrong
- A. Enabling HIDS (Host-based Intrusion Detection System) is a security monitoring tool that would not restore connectivity.
- B. Service account permissions are unlikely to be affected by a patch update and wouldn't typically be the first troubleshooting step.
- C. While firewall rules could theoretically block database access, checking them comes after ruling out the obvious cause (the recent patch).
Question 133
A server technician is installing a new server OS on legacy server hardware. Which of the following should the technician do FIRST to ensure the OS will work as intended?
Show answer and explanation
Correct answer: A. Consult the HCL to ensure everything is supported
Before installing a new operating system on legacy server hardware, the technician should first consult the Hardware Compatibility List (HCL) to verify that all server components are officially supported by the OS.
Why the other options are wrong
- B. Migrating to a virtual server is a structural architectural change rather than a step to verify bare-metal OS compatibility.
- C. Low-level formatting erases drive data but does not resolve hardware driver or system compatibility issues.
- D. Cleaning hardware components ensures proper thermal performance but does not guarantee OS compatibility.
Question 134
A storage administrator needs to implement SAN-based shared storage that can transmit at 16Gb over an optical connection. Which of the following connectivity options would BEST meet this requirement?
Show answer and explanation
Correct answer: A. Fibre Channel
Fibre Channel is the industry standard for SAN (Storage Area Network) connectivity and natively supports 16Gb transmission speeds over optical fiber connections. It is specifically designed for high-speed, reliable block-level storage access in enterprise environments. FCoE, iSCSI, and eSATA do not provide the same native 16Gb optical performance characteristics.
Why the other options are wrong
- B. FCoE (Fibre Channel over Ethernet) encapsulates Fibre Channel over Ethernet and is not the native choice for 16Gb optical SAN connectivity.
- C. iSCSI uses IP networks and Ethernet, not optical Fibre Channel connections, for SAN connectivity.
- D. eSATA is an external drive interface, not a SAN protocol suitable for shared enterprise storage.
Question 135
An administrator is configuring a host-based firewall for a server. The server needs to allow SSH, FTP, and LDAP traffic. Which of the following ports must be configured so this traffic will be allowed? (Choose three.)
Show answer and explanation
Correct answer: A, B, H. 21; 22; 389
SSH uses port 22 (B), FTP uses ports 20 and 21 with 21 being the control port (A), and LDAP uses port 389 (H). These three ports are the standard defaults for these services and must be open on the firewall to allow the specified traffic. Port 21 is essential for FTP control connections, port 22 for SSH, and port 389 for LDAP queries.
Why the other options are wrong
- C. Port 53 is for DNS, not required for SSH, FTP, or LDAP.
- D. Port 67 is for DHCP, not required for the specified services.
- E. Port 69 is for TFTP, not required for the specified services.
- F. Port 110 is for POP3 email, not required for the specified services.
- G. Port 123 is for NTP time synchronization, not required for the specified services.
Question 136
A server administrator is installing an OS on a new server. Company policy states no one is to log in directly to the server. Which of the following installation methods is BEST suited to meet the company policy?
Show answer and explanation
Correct answer: B. Core
A Server Core installation installs a minimal OS footprint without a local Graphical User Interface (GUI), effectively forcing administrators to manage the server remotely and preventing direct local GUI logins.
Why the other options are wrong
- A. A GUI installation includes a local desktop interface, making direct local logins easy.
- C. Virtualization refers to running an OS inside a hypervisor and does not inherently prevent direct local console logins.
- D. Cloning is a deployment method for copying an existing OS image and does not dictate local login policies.
Question 137
Which of the following must a server administrator do to ensure data on the SAN is not compromised if it is leaked?
Show answer and explanation
Correct answer: B. Encrypt the data at rest
Encrypting data at rest protects stored data on SAN physical drives from being read or compromised if physical media is stolen or leaked.
Why the other options are wrong
- A. Encrypting data leaving the SAN protects data in transit, but does not secure the stored data on the SAN disks if the physical array is compromised.
- C. Encrypting host servers protects local host operating systems, but does not protect storage volumes hosted on the SAN.
- D. Encrypting network traffic prevents eavesdropping on data in transit, but leaves static data at rest on the SAN unprotected.
Question 138
A systems administrator has several different types of hard drives. The administrator is setting up a NAS that will allow end users to see all the drives within the NAS. Which of the following storage types should the administrator use?
Show answer and explanation
Correct answer: D. Just a bunch of disks
Just a Bunch of Disks (JBOD) architecture allows various heterogeneous hard drives to be presented to users individually or combined as standard storage without requiring identical drive specifications or RAID arrays.
Why the other options are wrong
- A. RAID arrays generally require matching drive capacities and configurations to function properly and provide performance or redundancy.
- B. Serial Attached SCSI is an interface protocol for connecting hard drives, not a storage architecture for presenting multiple drives.
- C. Solid-state drive refers to a specific media type rather than a multi-drive presentation topology.
Question 139
A company's IDS has identified outbound traffic from one of the web servers coming over port 389 to an outside address. This server only hosts websites. The company's SOC administrator has asked a technician to harden this server. Which of the following would be the BEST way to complete this request?
Show answer and explanation
Correct answer: A. Disable port 389 on the server
Since the server only hosts websites, LDAP traffic on port 389 is unnecessary and represents a potential security risk. Disabling unused ports is a standard server hardening practice to reduce the attack surface.
Why the other options are wrong
- B. Moving unneeded LDAP traffic to port 443 misconfigures web traffic protocols rather than securing the server.
- C. Moving traffic to port 637 does not remediate the unauthorized service and uses an improper port mapping.
- D. Port 389 is used for LDAP rather than web traffic, which operates over HTTP port 80 or HTTPS port 443.
Question 140
An administrator is investigating several unexpected documents and video files that recently appeared in a network share. The administrator checks the properties of the files and sees the author’s name on the documents is not a company employee. The administrator questions the other users, but no one knows anything about the files. The administrator then checks the log files and discovers the FTP protocol was used to copy the files to the server. Which of the following needs to be done to prevent this from happening again?
Show answer and explanation
Correct answer: D. Disable anonymous access.
The files were uploaded via FTP protocol by an unauthorized user. Disabling anonymous access to the FTP service prevents unauthenticated users from uploading files to the network share. This directly addresses the attack vector that was exploited in this incident.
Why the other options are wrong
- A. Data loss prevention monitors and prevents data exfiltration, not unauthorized file uploads.
- B. Intrusion detection would alert to the breach but wouldn't have prevented the FTP upload.
- C. User Account Control is a Windows privilege escalation mechanism unrelated to FTP protocol access.
Question 141
Which of the following BEST measures how much downtime an organization can tolerate during an unplanned outage?
Show answer and explanation
Correct answer: C. RTO
Recovery Time Objective (RTO) is the maximum amount of downtime an organization can tolerate and still meet business requirements. It directly measures the allowable downtime window for an unplanned outage. SLA is a service agreement, BIA is a business impact analysis process, and MTTR measures repair time, not tolerance for downtime.
Why the other options are wrong
- A. SLA is a service level agreement that defines service standards, not downtime tolerance.
- B. BIA (Business Impact Analysis) is a process to identify impacts, not a measure of downtime tolerance.
- D. MTTR (Mean Time To Repair) measures how long repairs typically take, not acceptable downtime duration.
Question 142
A remote physical server is unable to communicate to the network through the available NICs, which were misconfigured. However, the server administrator is still able to configure the server remotely. Which of the following connection types is the server administrator using to access the server?
Show answer and explanation
Correct answer: A. Out-of-band management
Out-of-band (OOB) management tools, such as iDRAC or iLO, use a dedicated management network interface card and controller that function independently of the main operating system and primary NIC configurations.
Why the other options are wrong
- B. Crash cart access requires a physical monitor and keyboard connected directly to the server in person, not remotely.
- C. A virtual administrator console relies on hypervisor tools or operating system services, which typically depend on valid OS networking.
- D. A local KVM setup requires direct physical presence in the server room.
- E. RDP connections operate in-band over the primary network interfaces, which are unavailable due to NIC misconfiguration.
Question 143
Users report they are unable to access an application after a recent third-party patch update. The physical server that is hosting the application keeps crashing on reboot. Although the update was installed directly from the manufacturer’s support website as recommended, it has now been recalled and removed from the website, as the update unintentionally installed unauthorized software after a reboot. Which of the following steps should the administrator perform to restore access to the application while minimizing downtime? (Choose two.)
Show answer and explanation
Correct answer: A, E. Uninstall recent updates; Scan and remove any malware.
To restore access while minimizing downtime, the administrator should first uninstall the recent patch (option A) to stop the server crashes and restore application access quickly. Then, they should scan and remove the malware (option E) that was installed by the unauthorized patch to ensure the system is clean. This two-step approach addresses both the immediate symptom (crashes from the patch) and the underlying security issue (malware installation). These steps are faster than reimaging or reformatting while achieving full remediation.
Why the other options are wrong
- B. Reimaging with a different OS is unnecessary and would increase downtime significantly without addressing the specific issue.
- C. Running a port scan verifies connectivity status but does not restore access to the application.
- D. A GPO cannot uninstall updates on a single server efficiently; this is an overly complex approach for immediate remediation.
- F. Reformatting and restoring from backup would take excessive time; simpler remediation options work first.
Question 144
Which of the following BEST describes the metric that is used to measure server downtime?
Show answer and explanation
Correct answer: A. MTTR
Mean Time To Repair (MTTR) is the metric that specifically measures how long it takes to restore a system to operational status, directly quantifying server downtime. This is the standard industry metric for measuring recovery and repair times.
Why the other options are wrong
- B. BIA (Business Impact Analysis) is a planning tool that identifies business requirements, not a measure of downtime itself.
- C. RPO (Recovery Point Objective) measures how much data loss is acceptable, not the duration of downtime.
- D. SLA (Service Level Agreement) is a contract defining performance targets, not the metric used to measure actual downtime.
Question 145
A human resources analyst is attempting to email the records for new employees to an outside payroll company. Each time the analyst sends an email containing employee records, the email is rejected with an error message. Other emails outside the company are sent correctly. Which of the following is most likely generating the error?
Show answer and explanation
Correct answer: C. DLP software
DLP (Data Loss Prevention) software is specifically designed to monitor and block the transmission of sensitive data, such as employee records, outside the organization. The fact that other emails send correctly indicates the network infrastructure is working properly, eliminating DHCP and general firewall issues. DLP software would selectively block emails containing sensitive employee information while allowing other traffic to pass through normally.
Why the other options are wrong
- A. DHCP configuration would affect all network communication, not just specific email content.
- B. Firewall rules would block all external emails, not just those with employee records.
- D. An IDS alerts on suspicious traffic but does not block emails based on content.
Question 146
A technician is configuring a server that requires secure remote access. Which of the following ports should the technician use?
Show answer and explanation
Correct answer: B. 22
Port 22 is used by Secure Shell (SSH), which provides encrypted and secure remote CLI access to servers.
Why the other options are wrong
- A. Port 21 is used for unencrypted File Transfer Protocol (FTP) command control.
- C. Port 23 is used for Telnet, which transmits data and login credentials in cleartext.
- D. Port 443 is used for HTTPS web traffic rather than remote command-line server administration.
Question 147
Network connectivity to a server was lost when it was pulled from the rack during maintenance. Which of the following should the server administrator use to prevent this situation in the future?
Show answer and explanation
Correct answer: A. Cable management
Proper cable management, such as using cable management arms with sufficient slack, ensures that cables remain securely routed and connected when servers are extended out on slide rails during maintenance.
Why the other options are wrong
- B. Rail kits allow the server to slide out of the rack but do not hold or route the network cables by themselves.
- C. Wireless connections are not suitable or reliable standard infrastructure for high-performance server datacenter networking.
- D. A power distribution unit (PDU) supplies electrical power to servers rather than securing network cables.
Question 148
A server administrator is completing an OS installation for a new server. The administrator patches the server with the latest vendor-suggested software, configures DHCP, and verifies all network cables are properly connected in the IDF, but there is no network connectivity. Which of the following is the MOST likely reason for the lack of connectivity?
Show answer and explanation
Correct answer: A. The VLAN is improperly configured.
After patching, configuring DHCP, and verifying physical connections are all correct, VLAN misconfiguration is the most likely culprit preventing network connectivity. The server may be on a different VLAN than expected, the VLAN may not be properly tagged on the switch port, or the VLAN routing may be misconfigured. This is a common configuration issue that occurs even when patches and physical connections are correct.
Why the other options are wrong
- B. DNS configuration issues would not prevent initial network connectivity; they only affect name resolution.
- C. OS version compatibility is extremely unlikely to cause complete network failure; drivers are typically backward compatible.
- D. HIDS would not typically prevent basic network connectivity unless explicitly configured with deny rules.
Question 149
Which of the following relates to how much data loss a company agrees to tolerate in the event of a disaster?
Show answer and explanation
Correct answer: C. PRO
RPO (Recovery Point Objective, referred to here as PRO) measures the maximum acceptable amount of data loss measured in time following a disaster or disruption.
Why the other options are wrong
- A. RTO (Recovery Time Objective) defines the maximum acceptable duration of downtime rather than data loss.
- B. MTBF (Mean Time Between Failures) measures the expected operational time between inherent system failures.
- D. MTTR (Mean Time to Repair) represents the average time required to repair a failed component or system.
Question 150
A server administrator needs to harden a server by only allowing secure traffic and DNS inquiries. A port scan reports the following ports are open: 443 636 Which of the following open ports should be closed to secure the server properly? (Choose two.)
Show answer and explanation
Correct answer: A, C. 21; 23
Port 21 (FTP) and Port 23 (Telnet) transmit traffic in cleartext and should be closed to harden the server, whereas DNS (Port 53), HTTPS (Port 443), SSH (Port 22), and LDAPS (Port 636) provide secure communications or required DNS services.
Why the other options are wrong
- B. Port 22 is used for Secure Shell (SSH), which provides secure encrypted administration traffic.
- D. Port 53 is used for DNS inquiries, which the administrator explicitly needs to allow.
- E. Port 443 is used for HTTPS, which provides secure encrypted web communication.
- F. Port 636 is used for LDAPS, which provides secure directory services over TLS/SSL.
Question 151
A server in a remote data center is no longer responsive. Which of the following is the BEST solution to investigate this failure?
Show answer and explanation
Correct answer: C. Out-of-band management
Out-of-band management (such as IPMI, iLO, or iDRAC) is the best solution for a completely unresponsive server because it operates independently of the main OS and network stack. When a server is no longer responsive, standard remote access methods like RDP or SSH will not work since the OS is not functioning. A crash cart requires physical presence, which is impractical for a remote data center. Out-of-band management provides emergency access regardless of OS state.
Why the other options are wrong
- A. Remote Desktop requires the OS and network stack to be functioning, which they are not on an unresponsive server.
- B. A crash cart requires physical presence in the data center and is not practical for initial remote diagnosis.
- D. SSH requires the OS and network services to be running, which are unavailable on an unresponsive server.
Question 152
A technician is troubleshooting a server issue. The technician has determined several possible causes of the issue and has identified various solutions. Which of the following should the technician do NEXT?
Show answer and explanation
Correct answer: B. Test each solution individually to determine the root cause, rolling back the changes in between each test.
The proper troubleshooting methodology is to test each potential solution individually in an isolated manner, then roll back changes between tests to ensure a clean state for the next test. This systematic approach isolates which solution actually resolves the issue and identifies the root cause. This follows the CompTIA troubleshooting model of testing one variable at a time.
Why the other options are wrong
- A. Consulting forums skips the proper troubleshooting process and may not address the specific server's unique situation.
- C. Implementing the shortest solution first is not methodical and may mask the actual root cause.
- D. Testing in succession without proper rollback between tests conflates multiple changes and makes root cause identification impossible.
Question 153
A server administrator added a new drive to a server. However, the drive is not showing up as available. Which of the following does the administrator need to do to make the drive available?
Show answer and explanation
Correct answer: A. Partition the drive.
A newly added physical drive must be partitioned before the operating system can use it. Partitioning creates usable logical volumes on the physical drive. Without partitioning, the drive exists but has no usable space allocated. Disk quotas limit usage, not availability; dynamic disk configuration is a Windows feature but secondary to partitioning; compression is a file-system feature that applies after the drive is available.
Why the other options are wrong
- B. Disk quotas restrict usage limits but do not make an unpartitioned drive available for use
- C. Converting to dynamic disk is a Windows management feature but does not make an uninitialized drive available
- D. Compression settings apply to volumes already in use and do not make a new drive available
Question 154
A server technician has been asked to upload a few files from the internal web server to the internal FTP server. The technician logs in to the web server using PuTTY, but the connection to the FTP server fails. However, the FTP connection from the technician's workstation is successful. To troubleshoot the issue, the technician executes the following command on both the web server and the workstation: ping ftp.acme.local The IP address in the command output is different on each machine. Which of the following is the MOST likely reason for the connection failure?
Show answer and explanation
Correct answer: C. A misconfigured hosts file
The local hosts file overrides DNS resolution; a custom or misconfigured host entry on one system causes ping to resolve hostnames to different IP addresses.
Why the other options are wrong
- A. A misconfigured firewall blocks or permits network packets, but it cannot alter hostname IP resolution during a ping test.
- B. The hosts.deny file restricts access to system services via TCP wrappers but does not handle domain name resolution.
- D. The hosts.allow file grants access to TCP wrapper services and does not influence domain name to IP mapping.
That was 154 of 617.
The full CompTIA Server+ SK0-005 pack has all 617 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 308 free as one PDF by email. Get the Half Pack →