CompTIA SK0-005 Practice Test 46
Question 450
A change board is planning a verified response to this server event: A break-glass account is shared by three administrators and used daily with no individual audit attribution. For the MFA and just-in-time administration issue, which response elements belong in the approved plan? Select TWO answers.
- Classify sensitive records and enforce least-necessary access, approved retention and controlled export or redaction.
- Disable MFA for all administrators because a single recovery account needs an emergency procedure.
- Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
- The user completes the approved task without access to unrelated management planes or data.
- Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing.
Explanation
Correct Answer
C:The expected technical relationship is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.
E:Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.
Incorrect Answers
A:For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. It does not directly address the reported MFA and just-in-time administration fault or prove its repair.
B:Discriminate using: Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
D:For this incident, the relevant principle is: Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability. This statement concerns RBAC and privileged separation, a different Server+ technical control.
Question 451
A server administrator is investigating a server issue involving service-account secret rotation and scope: A backup agent runs as a domain administrator with a password that has not been rotated in years. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
- Reuse one unrotated administrator password for every unattended service.
- Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
- Require MFA for interactive privileged access and controlled just-in-time or emergency access with accountable auditing.
Explanation
Correct Answer
A:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Incorrect Answers
B:This is the unsafe shortcut in the Service-account secret rotation and scope scenario, not a justified remediation or diagnostic. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
C:That option would grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews, but it addresses a different concern. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
D:This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
Question 452
While reviewing the CompTIA Server+ administration incident, a technician learns: A backup agent runs as a domain administrator with a password that has not been rotated in years. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Physical access can bypass many software controls; identity, escort and audit are needed at equipment boundaries.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Explanation
Correct Answer
C:Applying it leads to this operational action: Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
Incorrect Answers
A:This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
B:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
D:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
Question 453
Before a server change is approved, the on-call engineer receives this incident report: A backup agent runs as a domain administrator with a password that has not been rotated in years. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
- Reuse one unrotated administrator password for every unattended service.
- Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
- Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
Explanation
Correct Answer
C:These observations investigate the exact Service-account secret rotation and scope failure rather than unrelated components. Incident: A backup agent runs as a domain administrator with a password that has not been rotated in years.
Incorrect Answers
A:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
B:This is the unsafe shortcut in the Service-account secret rotation and scope scenario, not a justified remediation or diagnostic. Incident: A backup agent runs as a domain administrator with a password that has not been rotated in years.
D:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Question 454
After the team implements a targeted remediation for Service-account secret rotation and scope, the original incident was: A backup agent runs as a domain administrator with a password that has not been rotated in years. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
- The user completes the approved task without access to unrelated management planes or data.
- Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
- Only authorized destinations retain the required minimized data for the approved period, with traceable deletion or archival.
Explanation
Correct Answer
C:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Incorrect Answers
A:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair.
B:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
D:This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
Question 455
A change board is planning a verified response to this server event: A backup agent runs as a domain administrator with a password that has not been rotated in years. For the Service-account secret rotation and scope issue, which response elements belong in the approved plan? Select ONE best answer.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage. Then validate the change by confirming: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
- Measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Reuse one unrotated administrator password for every unattended service.
Explanation
Correct Answer
A:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. The proposed change and outcome assessment work together for Service-account secret rotation and scope.
Incorrect Answers
B:That option would measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability, but it addresses a different concern. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
C:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
D:This is the unsafe shortcut in the Service-account secret rotation and scope scenario, not a justified remediation or diagnostic. Discriminate using: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
Question 456
A server administrator is investigating a server issue involving service-account secret rotation and scope: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
- Reuse one unrotated administrator password for every unattended service.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
Explanation
Correct Answer
A:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Incorrect Answers
B:This is the unsafe shortcut in the Service-account secret rotation and scope scenario, not a justified remediation or diagnostic. Incident: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes.
C:That option would enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy, but it addresses a different concern. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
D:That option would enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures, but it addresses a different concern. Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Question 457
While reviewing the CompTIA Server+ administration incident, a technician learns: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
- Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Explanation
Correct Answer
D:Applying it leads to this operational action: Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage. This is the controlling principle for the reported Service-account secret rotation and scope incident.
Incorrect Answers
A:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
B:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
C:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
Question 458
Before a server change is approved, the on-call engineer receives this incident report: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Reuse one unrotated administrator password for every unattended service.
- Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
Explanation
Correct Answer
B:These observations investigate the exact Service-account secret rotation and scope failure rather than unrelated components. The expected technical relationship is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Incorrect Answers
A:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
C:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. This statement concerns Decommissioning service identities and asset records, a different Server+ technical control.
D:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. This statement concerns Media sanitization by classification, a different Server+ technical control.
Question 459
After the team implements a targeted remediation for Service-account secret rotation and scope, the original incident was: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Highest-risk reachable vulnerabilities are remediated or formally mitigated, then rescans confirm closure.
- Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.
- Known authorized boot components load and tampering is detected without losing recovery access.
- Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
Explanation
Correct Answer
D:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
Incorrect Answers
A:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
B:This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair. For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. A targeted investigation checks: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage. The desired recovery condition is: Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
C:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair.
Question 460
A change board is planning a verified response to this server event: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes. For the Service-account secret rotation and scope issue, which response elements belong in the approved plan? Select TWO answers.
- Reuse one unrotated administrator password for every unattended service.
- Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Privileged sessions require approved factors and are attributable to an identity, with tested emergency recovery.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
Explanation
Correct Answer
B:These observations investigate the exact Service-account secret rotation and scope failure rather than unrelated components. Incident: An application token is committed to a configuration repository and reused across staging and production with unrestricted API scopes.
E:Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. This is the appropriate targeted correction for Service-account secret rotation and scope.
Incorrect Answers
A:Discriminate using: Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
C:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. It does not directly address the reported Service-account secret rotation and scope fault or prove its repair.
D:For this incident, the relevant principle is: Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials. This statement concerns MFA and just-in-time administration, a different Server+ technical control.
