CompTIA Server+ Practice Test (SK0-005)

The correct answer is to boot the server into Safe Mode. Safe Mode starts Windows with a minimal set of drivers and services, which is ideal for troubleshooting issues like the one described. Since the problem occurred immediately after a driver update, it is highly probable that the new driver is causing a conflict that prevents the OS from loading normally. Booting into Safe Mode would likely bypass the faulty driver, allowing the administrator to log in, access Device Manager, and roll back or uninstall the problematic driver.

Reloading the OS from a backup is a recovery step, not a diagnostic one. It should be considered only after troubleshooting attempts have failed, as it is a more drastic measure. Running hardware diagnostics is inappropriate because the scenario strongly indicates a software problem (a driver update) rather than a hardware failure. The runas command is used to execute a program with different user credentials while already logged into the OS and is irrelevant for a server that cannot boot.

The most probable cause is a loose power or data connector on the drive backplane. The recent physical maintenance involving cable rerouting makes a physical connectivity issue highly likely. Since all drives, which are connected via the backplane, went offline simultaneously and their activity lights are off, it points to a common failure point that provides both power and data connectivity to the entire set of drives. Reseating the backplane's main power and data (SAS/SATA) cables is the correct first step in troubleshooting.

• A RAID controller cache battery failure typically results in the write cache being disabled, leading to significant performance degradation, but it does not usually cause the entire array to go offline. The drives would still be detected by the controller.
• A simultaneous failure of multiple physical drives is statistically very improbable. Following troubleshooting methodology, a common point of failure should be investigated before assuming multiple independent failures.
• An OS patch failure would manifest after the hardware initialization phase. Since the issue is reported by the RAID controller's firmware before the operating system boots, an OS-level problem is not the root cause.

The correct answer is that the server's operating system has an incorrect route table configuration. In a multi-homed server scenario, the OS must have a correctly configured routing table to direct traffic to networks not on directly connected subnets. Since the server can reach its local subnets and the internet (via the default gateway, likely on NIC1), but not a specific remote subnet (10.0.20.0/24), it indicates a missing or incorrect static route. The OS doesn't know to send traffic for 10.0.20.15 via the gateway on the management network (NIC2). An administrator would use a command like route print on Windows or ip route on Linux to view the table and add a persistent static route to resolve the issue.

• A VLAN misconfiguration would likely disrupt all communication on the affected NIC's subnet, but the scenario states that communication on the 192.168.50.0/24 subnet is working correctly.
• A DNS server failure is irrelevant because the administrator is attempting to connect via an IP address, which does not require DNS resolution.
• An incorrect default gateway assigned by DHCP is less likely to be the root cause. A multi-homed server typically has only one default gateway to avoid routing conflicts. The problem is the lack of a specific route to a remote network, not an issue with the default route for all outbound traffic.

The correct answer is that the CMOS battery has failed. The Complementary Metal-Oxide-Semiconductor (CMOS) battery provides constant power to the motherboard to retain system settings such as the system time, date, and hardware configuration (including boot order) stored in the UEFI/BIOS. The symptoms described - a reset system clock and the loss of boot order settings after a power cycle - are classic indicators of a failed CMOS battery. A faulty PSU would likely prevent the server from powering on at all or cause random shutdowns, but it would not specifically erase saved BIOS settings. A failed RAID controller cache battery would affect the storage array's performance or integrity but would not impact the system's main clock or general BIOS settings. A corrupted BIOS might prevent the system from booting entirely or display different error messages, but the ability to enter setup and make changes that are subsequently lost points specifically to the component responsible for retaining those settings: the CMOS battery.

Under a per-socket licensing model, the software vendor charges for each occupied CPU socket, regardless of how many cores are inside that processor. Because the socket count on the host stays at two, replacing 12-core CPUs with 32-core CPUs does not require extra licenses or fees.

By contrast, a per-core model would become more expensive when core counts rise, a per-virtual-machine model ties cost to the number of guest instances rather than hardware, and a per-concurrent-user model is based on active sessions, none of which address the hardware-upgrade scenario described.

The correct action is to revert the virtual machine to the pre-update snapshot. When a patch or update causes a critical service failure in a production environment, the top priority is to restore service as quickly and safely as possible. Reverting to a known-good snapshot is the most reliable and fastest method to reverse the change that caused the problem. After restoring service, the administrator should then create a plan to test the failed patch in a non-production environment to diagnose the dependency issue without affecting live users. Attempting to manually downgrade a single library or find a new application version on a live production server is risky and time-consuming. Manually creating a symbolic link is an unstable workaround that can cause further system instability and should be avoided in production environments.

FCoE traffic must traverse a lossless Ethernet link. Losslessness is delivered by IEEE Data Center Bridging features-chiefly Priority Flow Control (PFC, 802.1Qbb)-which are negotiated between the switch and the CNA with DCBX. When PFC is not enabled or the DCBX negotiation fails, the switch marks the vFC interface "FCoE down," so the CNA never completes the FCoE Initialization Protocol. Enabling Data Center Bridging with the appropriate PFC settings lets the switch and CNA agree on a no-drop traffic class; once the link is lossless, FIP succeeds and the vFC interface comes up. Adjusting MTU, forming an LACP port-channel, or toggling Spanning Tree features affects only standard Ethernet operation and does not satisfy FCoE's mandatory lossless requirement, leaving the vFC link down.

Running Sysprep with the /generalize switch removes computer-specific data-including the machine SID, event-log history, and activation identifiers-so that every cloned instance generates unique values during its first boot (OOBE). This procedure is Microsoft's supported method for preparing a Windows installation that will be captured or physically duplicated. Converting the disk to MBR, disabling Secure Boot, or replacing the hardware duplicator with MDT imaging does not address duplicate SID or activation issues and therefore will not prevent the cloning problems described.

Group-membership changes are written to the Security log only when the Audit Account Management policy (or its granular Advanced Audit sub-categories such as Security Group Management) is enabled. With this setting turned on, event IDs like 4728 (member added to a global group) and 4729 (member removed) are generated, allowing the SIEM to retain evidence for 90 days or longer.

Audit Logon Events records logon and logoff activity, not account or group modifications. Audit Process Tracking captures detailed process start and stop information, which is unrelated to group management. Audit Object Access logs access to files, registry keys, and other securable objects, but it does not capture the creation or modification of security groups. Therefore, enabling Audit Account Management is the correct way to meet the requirement.

A rope-style leak-detection cable is engineered to sense water anywhere along its conductive "rope" and is routinely installed beneath raised floors or secured to overhead piping in data centers. The sensor triggers as soon as moisture touches any point on the cable, providing the earliest possible warning.

Photoelectric smoke detectors look for airborne particulates generated by combustion and cannot detect liquid. Differential air-pressure sensors measure pressure differences between aisles or plenums to validate airflow and HVAC performance, not leaks. Passive infrared (PIR) motion sensors register changes in infrared energy caused by moving people or objects and likewise offer no capability to sense water. Therefore, only the rope-style leak-detection cable meets the stated need for immediate notification of a chilled-water leak.

The client-diagnostics action Collect Client Logs instructs the selected SCCM client to compress all of its CCM log files (up to 100 MB) and upload them to the management point, where they can be opened from Resource Explorer on the site server. This provides immediate access to the logs needed for troubleshooting without requiring interactive login.

• Enable verbose logging only changes the detail level of future log entries and does not retrieve existing logs.
• Evaluate software update deployments launches a compliance scan but does not copy log files to the site server.
• Download computer policy forces a policy refresh; again, no log files are transferred.

Therefore, Collect Client Logs is the correct action.

Integrating a required "update affected documentation" step into the formal change-management workflow ensures that every Request for Change (RFC) is not closed until runbooks, diagrams, and other artifacts are revised and re-published. ITIL defines a service change as the addition, modification, or removal of a service component and its associated documentation, and lists documentation review/closure as part of the change process. PDF-locking, watermarks, or quarterly reviews can help, but they do not guarantee that documents are updated immediately after each change, so stale information can still circulate.

Water-leak detection sensors (often implemented as rope or spot probes) complete an electrical circuit the moment conductive liquid touches the element, allowing the DCIM or BMS to raise an alarm before moisture reaches power or network equipment. Differential air-pressure sensors only measure airflow imbalance, PIR motion sensors detect the heat signature of people or animals, and vibration/accelerometer sensors look for seismic or mechanical shaking-none of which will detect the presence of water.

The correct answer is to create a slipstreamed installation media and use an answer file for an unattended installation. Slipstreaming is the process of integrating patches, service packs, and drivers directly into the operating system installation source files. This meets the requirement for all updates to be included "from the outset". An unattended installation uses an answer file (e.g., unattend.xml) to provide all the necessary configuration details, which fully automates the setup process and requires no manual intervention. Combining these two methods is the most efficient and accurate way to meet all the scenario's requirements.

• Performing a network installation and then running a post-installation script is incorrect because the patches are applied after the initial OS installation, not from the outset.
• Creating a "golden image" from a manually configured master server is a viable deployment strategy, but it is less flexible than using a slipstreamed source with an answer file. The slipstream/unattended method allows for easier updates to the source and modification of the answer file for different roles, without having to rebuild an entire disk image.
• Cloning a virtual machine to a physical server (V2P) is a complex migration process, not a standard deployment method. It often leads to significant driver and Hardware Abstraction Layer (HAL) issues, making it unsuitable for deploying new, identical servers.

The correct answer describes the best practice for ensuring high availability and serviceability. Connecting each power supply to a separate PDU on opposite sides of the rack provides power source redundancy and physical path redundancy. If one PDU fails or requires maintenance, the server remains operational via the second PDU. Routing the cables on opposite sides prevents a single physical incident from severing both power connections. Using hook-and-loop straps is the preferred method for securing cables in a data center as they are reusable, adjustable, and less likely to damage cables compared to plastic zip ties which can be over-tightened.

Connecting both power cables to the same PDU creates a single point of failure, negating the benefit of having dual power supplies. Bundling the two redundant power cables together also creates a physical single point of failure; if the bundle is accidentally cut or unplugged, the server loses all power. While labeling cables is a good practice, it does not address the primary requirement of power redundancy and availability.