cert
cert-1
cert-2

Pass CompTIA SK0-005 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
SK0-005 Exam - Verified By Experts
SK0-005 Premium Bundle
$29.98

SK0-005 Premium Bundle

$79.99
$109.97
  • Premium File 617 Questions & Answers. Last update: Nov 13, 2026
  • Training Course 139 Video Lectures
  • Study Guide 533 Pages
 
$109.97
$79.99
accept 21 downloads in last 7 days
block-screenshots
Purchase CompTIA SK0-005 Exam Training Products Individually
CompTIA SK0-005 Premium File
Premium File 617 Q&A
$76.99$69.99
CompTIA SK0-005 Video Training Course
Training Course 139 Lectures
$21.99 $19.99
CompTIA SK0-005 PDF Study Guide
Study Guide 533 Pages
$21.99 $19.99
CompTIA SK0-005 Practice Test 45

Question 440

A change board is planning a verified response to this server event: A contractor responsible for database exports is granted unrestricted hypervisor and backup administrator roles. For the RBAC and privileged separation issue, which response elements belong in the approved plan? Select TWO answers.

  1. Give every support worker full administrator rights to reduce ticket volume.
  2. Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
  3. Review effective access, role inheritance, audit logs and task-specific permission requirements.
  4. Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
  5. Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.

Explanation

Correct Answer

B:

Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.

C:

The expected technical relationship is: Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights. Confirm remediation through: The user completes the approved task without access to unrelated management planes or data.

Incorrect Answers

A:

Discriminate using: Review effective access, role inheritance, audit logs and task-specific permission requirements.

D:

This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported RBAC and privileged separation fault or prove its repair.

E:

That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.

Question 441

A server administrator is investigating a server issue involving mfa and just-in-time administration: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
  2. Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing.
  3. Disable MFA for all administrators because a single recovery account needs an emergency procedure.
  4. Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.

Explanation

Correct Answer

B:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Incorrect Answers

A:

That option would grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews, but it addresses a different concern. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

C:

This is the unsafe shortcut in the MFA and just-in-time administration scenario, not a justified remediation or diagnostic. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

D:

That option would use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage, but it addresses a different concern. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Question 442

While reviewing the CompTIA Server+ administration incident, a technician learns: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. Physical access can bypass many software controls; identity, escort and audit are needed at equipment boundaries.
  2. Risk-based remediation combines technical severity and local exposure; score alone does not establish operational priority.
  3. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
  4. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Explanation

Correct Answer

D:

Applying it leads to this operational action: Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing. Collect evidence first: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

Incorrect Answers

A:

This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

B:

This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

C:

This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

Question 443

Before a server change is approved, the on-call engineer receives this incident report: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Check asset exposure, affected software versions, exploit availability, scan confidence and compensating controls.
  2. Disable MFA for all administrators because a single recovery account needs an emergency procedure.
  3. Review effective access, role inheritance, audit logs and task-specific permission requirements.
  4. Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

Explanation

Correct Answer

D:

The expected technical relationship is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Incorrect Answers

A:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

B:

This is the unsafe shortcut in the MFA and just-in-time administration scenario, not a justified remediation or diagnostic. Discriminate using: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

C:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Question 444

After the team implements a targeted remediation for MFA and just-in-time administration, the original incident was: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. Decommissioned media has verifiable sanitization or destruction evidence matching policy.
  2. Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.
  3. Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
  4. Known authorized boot components load and tampering is detected without losing recovery access.

Explanation

Correct Answer

B:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Incorrect Answers

A:

This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair.

C:

This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

D:

This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

Question 445

A change board is planning a verified response to this server event: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing. For the MFA and just-in-time administration issue, which response elements belong in the approved plan? Select ONE best answer.

  1. Disable MFA for all administrators because a single recovery account needs an emergency procedure.
  2. Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
  3. Prioritize verified vulnerabilities by exploitability, exposure and business impact; apply supported remediations with evidence.
  4. Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing. Then validate the change by confirming: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

Explanation

Correct Answer

D:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. Before modifying systems, gather: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

Incorrect Answers

A:

This is the unsafe shortcut in the MFA and just-in-time administration scenario, not a justified remediation or diagnostic. Incident: A remote server console allows password-only logins from the public internet and is targeted by credential stuffing.

B:

This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

C:

This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair.

Question 446

A server administrator is investigating a server issue involving mfa and just-in-time administration: A break-glass account is shared by three administrators and used daily with no individual audit attribution. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing.
  2. Disable MFA for all administrators because a single recovery account needs an emergency procedure.
  3. Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
  4. Monitor temperature, humidity, water and fire risks with alarms and approved cooling or suppression response plans.

Explanation

Correct Answer

A:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. Before rollout, confirm the problem with: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

Incorrect Answers

B:

This is the unsafe shortcut in the MFA and just-in-time administration scenario, not a justified remediation or diagnostic. Incident: A break-glass account is shared by three administrators and used daily with no individual audit attribution.

C:

That option would keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention, but it addresses a different concern. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

D:

That option would monitor temperature, humidity, water and fire risks with alarms and approved cooling or suppression response plans, but it addresses a different concern. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Question 447

While reviewing the CompTIA Server+ administration incident, a technician learns: A break-glass account is shared by three administrators and used daily with no individual audit attribution. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
  2. Data-protection controls should follow sensitivity and approved retention; a technically reachable storage bucket is not automatically an authorized destination.
  3. Physical environmental hazards can cause correlated service failures and must be detected before hardware shutdown.
  4. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Explanation

Correct Answer

D:

Applying it leads to this operational action: Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing. This is the controlling principle for the reported MFA and just-in-time administration incident.

Incorrect Answers

A:

This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

B:

This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

C:

This statement concerns Environmental monitoring and suppression, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

Question 448

Before a server change is approved, the on-call engineer receives this incident report: A break-glass account is shared by three administrators and used daily with no individual audit attribution. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Review backup job logs, quiesce/VSS status, restore checksums, ACLs and test-start results.
  2. Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
  3. Review classification labels, export audit logs, retention settings, access grants and sample records.
  4. Disable MFA for all administrators because a single recovery account needs an emergency procedure.

Explanation

Correct Answer

B:

The expected technical relationship is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. These observations investigate the exact MFA and just-in-time administration failure rather than unrelated components.

Incorrect Answers

A:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control.

C:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. This statement concerns Data classification and retention controls, a different Server+ technical control.

D:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Question 449

After the team implements a targeted remediation for MFA and just-in-time administration, the original incident was: A break-glass account is shared by three administrators and used daily with no individual audit attribution. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.
  2. The user completes the approved task without access to unrelated management planes or data.
  3. Approved application flows work and unrelated lateral movement attempts are denied and logged.
  4. A controlled simulated environmental warning reaches responders in time and temperature stays within equipment range.

Explanation

Correct Answer

A:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. Compare against pre-change evidence: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

Incorrect Answers

B:

This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

C:

This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair. For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. A targeted investigation checks: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use. The desired recovery condition is: Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.

D:

This statement concerns Environmental monitoring and suppression, a different Server+ technical control. It does not directly address the reported MFA and just-in-time administration fault or prove its repair.

Question 450

A change board is planning a verified response to this server event: A break-glass account is shared by three administrators and used daily with no individual audit attribution. For the MFA and just-in-time administration issue, which response elements belong in the approved plan? Select TWO answers.

  1. Classify sensitive records and enforce least-necessary access, approved retention and controlled export or redaction.
  2. Disable MFA for all administrators because a single recovery account needs an emergency procedure.
  3. Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
  4. The user completes the approved task without access to unrelated management planes or data.
  5. Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing.

Explanation

Correct Answer

C:

The expected technical relationship is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

E:

Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.

Incorrect Answers

A:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. It does not directly address the reported MFA and just-in-time administration fault or prove its repair.

B:

Discriminate using: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.

D:

For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. This statement concerns RBAC and privileged separation, a different Server+ technical control.

CompTIA Server+ Certification Exam (SK0-005) Practice Tests