CompTIA Server+ Practice Test (SK0-005)

The correct answer is Full Disk Encryption (FDE). FDE is designed to encrypt all data on a storage device, including the operating system, application files, and temporary files. This method directly addresses the scenario's requirement to make the entire drive's contents unreadable if the physical drives are stolen. Once the system is booted and the key is provided, the process is largely transparent to the OS and applications.

• Transport Layer Security (TLS) is incorrect because it is a protocol used to encrypt data in transit over a network, not data at rest on a storage device.
• File-level encryption is incorrect because it encrypts individual files or folders, not the entire disk. While a form of data-at-rest encryption, it would not protect the operating system or other unencrypted files on the disk, making it less comprehensive than FDE for this scenario.
• Database encryption (such as Transparent Data Encryption or TDE) is incorrect because it is specific to securing database files. This solution would not encrypt the operating system or other non-database files on the server.

In a per-core (also called core-based) licensing model, the customer must purchase a license for every physical processor core that is present or enabled on the host. Logical processors created by Hyper-Threading/SMT are ignored, and the license fee is not tied to sockets, servers, or user counts. Per-socket licenses would be based on the number of CPU packages, per-server licenses would charge a flat fee per machine, and per-concurrent-user models meter active user sessions rather than hardware resources. Therefore, the scenario describes a per-core model.

HPE documentation states that a drive whose status LED is blinking amber-especially when accompanied by a predictive-failure SMART message-has been marked by the RAID controller as likely to fail soon. Vendor guidance is to replace that specific drive as soon as possible via the hot-swap procedure so the array can rebuild before an unplanned outage occurs. Simply clearing logs or hiding LEDs does not remove the imminent risk, relocating the drive may trigger an immediate hard failure, and waiting for an additional drive to fail would put the RAID-5 set at high risk of total data loss.

Hardware hardening reduces the attack surface by removing or disabling components that the workload does not need. Because the servers must not use wireless networking, the most direct and reliable control is to disable the integrated Wi-Fi/Bluetooth adapter in system firmware (UEFI/BIOS). Doing so physically prevents the radio from transmitting or receiving and eliminates the associated drivers and services at the OS level. Enabling 802.1X on wired NICs secures Ethernet access but leaves the wireless interface active. Installing a host-based firewall is a software control that still allows the wireless hardware to function and does not meet the policy's prohibition. Replacing antenna leads with shielded cabling would be an improvised mitigation and still leaves the device powered and detectable. Therefore, disabling the onboard wireless adapter in firmware is the correct, policy-compliant hardening step.

The /MIR switch mirrors the directory tree, combining /E and /PURGE so any item deleted on the source is also removed on the destination. /COPYALL is shorthand for /COPY:DATSOU and preserves data, attributes, timestamps, security (ACLs), owner, and auditing information-satisfying the metadata requirement more completely than /SEC. /LOG+ appends (rather than overwrites) output to the specified log file, and /MT:16 enables a 16-thread, multithreaded copy operation. The other commands each miss at least one requirement: using /E without /PURGE does not delete removed items, /SEC omits owner and audit data, /LOG overwrites the file, and /MT defaults to 8 threads in the third option.

The correct answer is RAID 1. RAID 1, or mirroring, writes identical data to two or more disks simultaneously. This configuration provides high availability and fault tolerance because if one drive fails, the system can continue to operate without interruption using the other drive. This directly meets the scenario's primary requirement for resilience against a single drive failure. RAID 0 (striping) offers improved performance but no fault tolerance; if one drive fails, the entire array is lost. RAID 5 (striping with parity) provides fault tolerance but requires a minimum of three drives, which is not an option in this scenario. JBOD (Just a Bunch of Disks) combines disks into a single logical volume but offers no redundancy or fault tolerance.

The correct answer is iSCSI initiator. In an iSCSI storage network, the client component that resides on the server (in this case, the hypervisor) is called the initiator. It is responsible for sending SCSI commands over the IP network to the iSCSI target. The iSCSI target is the storage system that provides the LUNs. A Fibre Channel HBA is hardware for a different storage protocol (Fibre Channel) that requires a dedicated network, not standard Ethernet. LUN masking is a security process configured on the target to control which initiators have access to specific LUNs; it is not the client component itself.

Best practice calls for locating an alternate processing site far enough away-and preferably on a different power grid and telecommunications infrastructure-so that the same natural disaster or utility failure cannot affect both locations. The facility in northern Georgia is hundreds of kilometers inland, outside the coastal hurricane evacuation zone, and served by a different electrical grid and carrier network, thereby minimizing correlated risk. The other options leave the secondary site in the same hurricane hazard zone, on the same power grid, or even in the same building as the primary data center, so a single regional incident could still take both sites offline.

The correct answer is that the company will lose the right to use the database application, leading to a service outage. A subscription license is essentially a rental; it grants the right to use the software only for the paid term. If the subscription lapses, access to the software is typically revoked, causing an immediate halt to any services dependent on it.

Continuing to use the software without updates is a characteristic of a lapsed maintenance plan on a perpetual license, not a subscription. In a perpetual model, the user owns the license indefinitely but pays for support and updates separately. A subscription model usually bundles software access, support, and updates together. While a vendor might offer a grace period or reduced functionality, the primary risk for a mission-critical application is the complete loss of service, not a downgrade. Facing legal action for non-compliance is a risk, but the immediate operational impact of the service stopping is a more significant and direct consequence of non-renewal.

The correct answer is a data breach. The scenario describes a classic indicator of data exfiltration, which is a type of data breach. Unexpected and large outbound data transfers to unknown locations are a primary sign that an unauthorized party has accessed the network and is stealing data. This process of recognizing the signs of an attack is the 'Identification' phase of incident response.

• Data corruption involves data being altered or destroyed, which is not indicated by the network traffic logs.
• While an insider threat could be the cause of the breach, the risk identified by the log evidence itself is the data breach (the event), not the actor (the insider).
• A hardware failure would more likely present as network errors, packet loss, or a loss of connectivity, not a large, successful data transfer.

A cold site is essentially an empty shell that provides only fundamental infrastructure (electricity, HVAC, network access). Because it contains no pre-installed servers, storage, or data, its recurring cost is the lowest of the common DR-site options. The trade-off is a longer recovery time while equipment is delivered, installed, and backups are restored-often several days-making it appropriate when an RTO of multiple days is acceptable.

A hot site, in contrast, is fully equipped and kept in sync with production workloads, offering near-immediate failover but at the highest operating cost. A warm site already hosts some hardware and possibly partial data replication, shortening recovery time but still costing more than a cold site. An active-active metropolitan cluster keeps live services running in two or more datacenters simultaneously; this provides the fastest recovery and virtually no downtime but is by far the most expensive to maintain. Therefore, the cold site is the only option that satisfies the strict cost constraint while meeting the stated four-day RTO.

The described process synthesizes a fresh full-backup file from backup data that already exists on the target device. Because it combines the previous full (or synthetic full) with all subsequent incrementals without pulling data from the protected server, it is a synthetic full backup. An active full backup would reacquire all source data over the network, a differential backup contains only the cumulative changes since the last full, and reverse incremental updates the existing full while storing deltas for roll-backs-none of which match the scenario.

Because traffic on VLAN 10 succeeds while all VLAN 30 frames are lost, the link clearly passes untagged (or access) traffic but not tagged VLAN 30 traffic. This occurs when the switch port (or aggregated port-channel) is configured as an access interface in VLAN 10 instead of an 802.1Q trunk that allows VLAN 30. In that state the switch will accept only VLAN 10 and drop any frames tagged for other VLANs, so virtual-machine traffic never reaches the upstream gateway. The other listed issues could degrade performance or block the entire link, but none would selectively affect only one additional tagged VLAN while leaving the native/management VLAN untouched.

The correct answer is that a Data Loss Prevention (DLP) policy has quarantined the file. The key evidence is the security log alert from the File Integrity Monitoring (FIM) system. FIM systems track changes to critical files by monitoring their cryptographic hashes. An unexpected hash change on a sensitive file, like a financial report, would trigger an alert. In a secure environment, this FIM alert can trigger an automated response from a Data Loss Prevention (DLP) system. The DLP system's response is often to quarantine the file, which makes it inaccessible to users as a protective measure against data tampering or exfiltration. The other options are less likely given the specific evidence. A domain lockout or a stopped local service would cause more widespread access issues, not an issue with a single file. While file system corruption is possible, the security log explicitly points to a security-related action, which should be the primary line of investigation.

The correct answer is 'Malicious insider threat'. This scenario describes an individual with authorized access (a former employee whose account was still active) intentionally causing harm. The actions of deleting files and clearing logs are deliberate and harmful, which are key characteristics of a malicious insider threat. An unintentional insider threat would involve an accident or mistake, not deliberate sabotage. Social engineering involves tricking someone to gain access, and while it can lead to an insider threat, the direct actions described here point to the insider threat itself as the primary risk. A backdoor is a covert method of bypassing authentication, whereas this scenario involves the use of legitimate (though improperly managed) credentials.

In Bash an until loop executes its body repeatedly while the test command returns a non-zero (false) exit status, and it stops as soon as that command succeeds (exit status 0). Because nc -z localhost 443 fails until the port is open, wrapping the command in an until loop makes the script wait and then continue automatically when the service is ready.

A while loop has the opposite logic (it repeats only while the test command succeeds), so it would loop after the port is already open and exit immediately when the port is closed. A for loop requires a predefined list or counter and would need extra logic to stop at the right time, while a case statement is used for single evaluations rather than continuous polling. Therefore, the until loop is the most appropriate construct.

Windows services that run under a domain or local user account must have the Log on as a service (SeServiceLogonRight) privilege. When a GPO removes that right-or overwrites it with a blank list-the service account cannot obtain a logon token, so Windows records Event ID 7000 and reports a logon failure. Re-granting the DOMAIN\backup_svc account the Log on as a service right (or moving it to a group that already has the right) allows the Service Control Manager to authenticate the account and start the BackupAgent service.

The other options would not resolve this symptom:

• Allow log on locally governs interactive console logons, not service logons.
• Log on as a batch job applies to scheduled tasks, not background services.
• Deny log on through Remote Desktop Services affects RDP sessions and would not prevent a service from starting.

Windows Server 2012 R2 reached the end of extended support on 10 October 2023. After that date Microsoft stops publishing security, non-security, and bug-fix updates, and most ISVs discontinue qualification of new versions of their products for the OS. Extended Security Updates (ESUs) are intended only as a short-term bridge; they supply critical/important security fixes but no new features or vendor-requested changes, so the backup agent would remain unsupported. Manually importing updates or isolating the host does not restore vendor support and leaves the organization with an aging platform that will become increasingly hard to maintain.

Performing an in-place upgrade (or a migration with minimal downtime) to a currently supported LTSC release such as Windows Server 2022 returns the server to the normal update channel and meets the backup vendor's minimum requirements, solving both problems while preserving the existing shares and data.

The correct answer is that the server has an incorrectly configured DNS resolver file. The error message Could not resolve hostname... Name or service not known specifically indicates a failure in the Domain Name System (DNS) resolution process. On Linux systems, the /etc/resolv.conf file is the primary configuration file for the DNS resolver, containing the IP addresses of the nameservers the system should query. If this file is empty, contains incorrect IP addresses for the DNS servers, or if the specified DNS servers are offline or unreachable, the server will be unable to translate hostnames into IP addresses, leading to this error. A firewall blocking the port would occur after name resolution and result in a connection timeout, not a hostname resolution error. An incorrect route would also manifest after name resolution, typically causing a 'Destination Host Unreachable' error. A disabled network adapter would prevent all network traffic, including the successful ping to the gateway mentioned in the scenario.

Off-site backup locations should be far enough from the primary site to avoid being affected by the same regional disaster. Industry guidance for seismic and other large-scale natural hazards recommends placing copies hundreds of kilometers away, on different utility grids and geological zones. A cloud region 450 km distant meets that requirement, giving the organization a geographically independent copy. The other options keep data in the same building, on the same storage system, or within the same urban area-all of which are likely to suffer the same earthquake damage and therefore do not provide true physical-location protection.