CompTIA SK0-005 Practice Test 39
Question 380
A change board is planning a verified response to this server event: A procurement team cannot distinguish commercial subscriptions from open-source packages across server images during renewal review. For the Open-source license obligations and audit issue, which response elements belong in the approved plan? Select TWO answers.
- Assume all open-source components permit unrestricted redistribution without attribution or conditions.
- Inspect package SBOM, license texts, modification/distribution history and subscription records.
- Installed instances and host resources are covered by documented valid entitlements after migration.
- Correct service startup ordering and resource limits, monitor dependency health and validate controlled restarts.
- Maintain a software bill of materials and honor relevant distribution, attribution and support-license obligations.
Explanation
Correct Answer
B:These observations investigate the exact Open-source license obligations and audit failure rather than unrelated components. The expected technical relationship is: Open-source use still carries license conditions, and support subscriptions are separate from copyright permissions.
E:Before rollout, confirm the problem with: Inspect package SBOM, license texts, modification/distribution history and subscription records. This is the appropriate targeted correction for Open-source license obligations and audit.
Incorrect Answers
A:Incident: A procurement team cannot distinguish commercial subscriptions from open-source packages across server images during renewal review.
C:A targeted investigation checks: Inspect package SBOM, license texts, modification/distribution history and subscription records.
D:This statement concerns Service dependency and restart management, a different Server+ technical control.
Question 381
A server administrator is investigating a server issue involving encryption at rest and key lifecycle: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Classify sensitive records and enforce least-necessary access, approved retention and controlled export or redaction.
- Restore supported TLS with a valid certificate chain, correct names and trusted issuers; keep client validation enabled.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
Explanation
Correct Answer
C:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. For this case, A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
Incorrect Answers
A:This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
B:This statement concerns TLS certificate chain and secure transport, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
D:This is the unsafe shortcut in the Encryption at rest and key lifecycle scenario, not a justified remediation or diagnostic. File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Question 382
While reviewing the CompTIA Server+ administration incident, a technician learns: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
- Patch management balances exposure reduction with service continuity using tested change windows and exception handling.
- Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.
Explanation
Correct Answer
B:This is the controlling principle for the reported Encryption at rest and key lifecycle incident. Scenario: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
Incorrect Answers
A:This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
C:This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
D:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
Question 383
Before a server change is approved, the on-call engineer receives this incident report: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Review classification labels, export audit logs, retention settings, access grants and sample records.
- Review backup job logs, quiesce/VSS status, restore checksums, ACLs and test-start results.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
Explanation
Correct Answer
C:These observations investigate the exact Encryption at rest and key lifecycle failure rather than unrelated components. Incident: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
Incorrect Answers
A:For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
B:For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. Incident: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
D:This is the unsafe shortcut in the Encryption at rest and key lifecycle scenario, not a justified remediation or diagnostic. Incident: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
Question 384
After the team implements a targeted remediation for Encryption at rest and key lifecycle, the original incident was: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.
- Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
- Users complete critical transactions in the alternate site, and a rehearsed failback restores a consistent primary.
- Clients establish mutually appropriate authenticated encrypted connections with verification enabled.
Explanation
Correct Answer
B:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. Incident: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing.
Incorrect Answers
A:This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair.
C:This statement concerns Site failover dependencies and failback, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
D:This statement concerns TLS certificate chain and secure transport, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair.
Question 385
A change board is planning a verified response to this server event: A storage team enables filesystem permissions but leaves backup disks unencrypted, and a retired drive containing customer records goes missing. For the Encryption at rest and key lifecycle issue, which response elements belong in the approved plan? Select ONE best answer.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy. Then validate the change by confirming: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Test application-consistent restores including data, logs, permissions and integrity at defined intervals.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
Explanation
Correct Answer
A:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. This avoids the unsafe shortcut: Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
Incorrect Answers
B:That option would compare listening ports, running services, local accounts and policy deviations against the approved baseline, but it addresses a different concern. File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
C:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair.
D:This is the unsafe shortcut in the Encryption at rest and key lifecycle scenario, not a justified remediation or diagnostic. Discriminate using: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
Question 386
A server administrator is investigating a server issue involving encryption at rest and key lifecycle: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
Explanation
Correct Answer
B:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. For this case, A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
Incorrect Answers
A:That option would apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols, but it addresses a different concern. File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
C:This is the unsafe shortcut in the Encryption at rest and key lifecycle scenario, not a justified remediation or diagnostic. Incident: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
D:That option would keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention, but it addresses a different concern. File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Question 387
While reviewing the CompTIA Server+ administration incident, a technician learns: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- RTO measures acceptable service restoration time; RPO measures acceptable data loss, and they drive different design choices.
- Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
- Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Explanation
Correct Answer
D:This is the controlling principle for the reported Encryption at rest and key lifecycle incident. Scenario: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
Incorrect Answers
A:This statement concerns RPO and RTO-driven disaster recovery, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
B:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
C:This statement concerns Disable unused services and secure baseline, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
Question 388
Before a server change is approved, the on-call engineer receives this incident report: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
- Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
Explanation
Correct Answer
C:These observations investigate the exact Encryption at rest and key lifecycle failure rather than unrelated components. Incident: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
Incorrect Answers
A:For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. Incident: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
B:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
D:For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. This statement concerns MFA and just-in-time administration, a different Server+ technical control.
Question 389
After the team implements a targeted remediation for Encryption at rest and key lifecycle, the original incident was: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
- Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
- Clients establish mutually appropriate authenticated encrypted connections with verification enabled.
- An offline or isolated restore point survives a simulated primary-site or administrator compromise.
Explanation
Correct Answer
B:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. Incident: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
Incorrect Answers
A:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
C:This statement concerns TLS certificate chain and secure transport, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. A targeted investigation checks: Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access. The desired recovery condition is: Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
D:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair.
Question 390
A change board is planning a verified response to this server event: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft. For the Encryption at rest and key lifecycle issue, which response elements belong in the approved plan? Select TWO answers.
- Rely only on operating-system ACLs while leaving portable backup disks and recovery keys unprotected.
- Select recovery architecture to meet quantified RTO and RPO, then validate both during controlled recovery exercises.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Clients establish mutually appropriate authenticated encrypted connections with verification enabled.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
Explanation
Correct Answer
C:File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability. This is the appropriate targeted correction for Encryption at rest and key lifecycle.
E:These observations investigate the exact Encryption at rest and key lifecycle failure rather than unrelated components. The expected technical relationship is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Incorrect Answers
A:Incident: A database host uses full-disk encryption but stores its recovery key on the same unprotected disk image, preventing secure recovery after a theft.
B:That option would select recovery architecture to meet quantified RTO and RPO, then validate both during controlled recovery exercises, but it addresses a different concern. File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
D:This statement concerns TLS certificate chain and secure transport, a different Server+ technical control. It does not directly address the reported Encryption at rest and key lifecycle fault or prove its repair. For this incident, the relevant principle is: File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
