CompTIA SK0-005 Practice Test 49
Question 480
A change board is planning a verified response to this server event: An appliance is known vulnerable but operators disable patching indefinitely without compensating controls or an exception review. For the Patching with staged rollback issue, which response elements belong in the approved plan? Select TWO answers.
- Apply untested kernel patches to all critical hosts simultaneously with no rollback or maintenance window.
- Enforce badges, role-based room or rack access, visitor logging and periodic access-review procedures.
- Stage vendor-supported security updates, validate application compatibility, keep rollback options and document temporary mitigations.
- Inspect advisories, dependency matrix, staging test results, maintenance plan and postpatch scans.
- Highest-risk reachable vulnerabilities are remediated or formally mitigated, then rescans confirm closure.
Explanation
Correct Answer
C:A successful outcome is: Patches deploy without unacceptable outage and vulnerability scans verify the intended fixed version. This is the appropriate targeted correction for Patching with staged rollback.
D:Confirm remediation through: Patches deploy without unacceptable outage and vulnerability scans verify the intended fixed version. The expected technical relationship is: Patch management balances exposure reduction with service continuity using tested change windows and exception handling.
Incorrect Answers
A:Patch management balances exposure reduction with service continuity using tested change windows and exception handling.
B:For this incident, the relevant principle is: Patch management balances exposure reduction with service continuity using tested change windows and exception handling. The desired recovery condition is: Patches deploy without unacceptable outage and vulnerability scans verify the intended fixed version.
E:For this incident, the relevant principle is: Patch management balances exposure reduction with service continuity using tested change windows and exception handling. It does not directly address the reported Patching with staged rollback fault or prove its repair.
Question 481
A server administrator is investigating a server issue involving disable unused services and secure baseline: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
- Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
Explanation
Correct Answer
C:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. For this case, A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened.
Incorrect Answers
A:This is the unsafe shortcut in the Disable unused services and secure baseline scenario, not a justified remediation or diagnostic. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
B:That option would enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures, but it addresses a different concern. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
D:That option would implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations, but it addresses a different concern. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
Question 482
While reviewing the CompTIA Server+ administration incident, a technician learns: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- Physical access can bypass many software controls; identity, escort and audit are needed at equipment boundaries.
- Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.
Explanation
Correct Answer
A:Applying it leads to this operational action: Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols. The acceptance test is: Only documented required services and accounts remain, with functional checks passing after hardening.
Incorrect Answers
B:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
C:This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
D:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
Question 483
Before a server change is approved, the on-call engineer receives this incident report: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
Explanation
Correct Answer
B:These observations investigate the exact Disable unused services and secure baseline failure rather than unrelated components. Incident: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened.
Incorrect Answers
A:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
C:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Incident: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened.
D:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. This is the unsafe shortcut in the Disable unused services and secure baseline scenario, not a justified remediation or diagnostic.
Question 484
After the team implements a targeted remediation for Disable unused services and secure baseline, the original incident was: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- A rehearsal restores end-to-end service within RTO and loses no more than allowed by RPO.
- Only documented required services and accounts remain, with functional checks passing after hardening.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
Explanation
Correct Answer
B:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Incident: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened.
Incorrect Answers
A:This statement concerns RPO and RTO-driven disaster recovery, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
C:This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
D:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair.
Question 485
A change board is planning a verified response to this server event: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened. For the Disable unused services and secure baseline issue, which response elements belong in the approved plan? Select ONE best answer.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols. Then validate the change by confirming: Only documented required services and accounts remain, with functional checks passing after hardening.
- Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
Explanation
Correct Answer
C:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. This avoids the unsafe shortcut: Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
Incorrect Answers
A:This is the unsafe shortcut in the Disable unused services and secure baseline scenario, not a justified remediation or diagnostic. Incident: A freshly installed server still runs anonymous FTP and an unused remote shell listener because the default image was never hardened.
B:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
D:This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
Question 486
A server administrator is investigating a server issue involving disable unused services and secure baseline: An application host exposes legacy management protocols and default sample accounts to every subnet. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
Explanation
Correct Answer
A:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. For this case, An application host exposes legacy management protocols and default sample accounts to every subnet.
Incorrect Answers
B:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Incident: An application host exposes legacy management protocols and default sample accounts to every subnet.
C:That option would grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews, but it addresses a different concern. Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
D:This is the unsafe shortcut in the Disable unused services and secure baseline scenario, not a justified remediation or diagnostic. Incident: An application host exposes legacy management protocols and default sample accounts to every subnet.
Question 487
While reviewing the CompTIA Server+ administration incident, a technician learns: An application host exposes legacy management protocols and default sample accounts to every subnet. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
- Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.
Explanation
Correct Answer
A:Applying it leads to this operational action: Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
Incorrect Answers
B:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
C:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
D:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
Question 488
Before a server change is approved, the on-call engineer receives this incident report: An application host exposes legacy management protocols and default sample accounts to every subnet. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
- Measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability.
Explanation
Correct Answer
B:These observations investigate the exact Disable unused services and secure baseline failure rather than unrelated components. Incident: An application host exposes legacy management protocols and default sample accounts to every subnet.
Incorrect Answers
A:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. This statement concerns Decommissioning service identities and asset records, a different Server+ technical control.
C:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Incident: An application host exposes legacy management protocols and default sample accounts to every subnet.
D:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Incident: An application host exposes legacy management protocols and default sample accounts to every subnet.
Question 489
After the team implements a targeted remediation for Disable unused services and secure baseline, the original incident was: An application host exposes legacy management protocols and default sample accounts to every subnet. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Only documented required services and accounts remain, with functional checks passing after hardening.
- Patches deploy without unacceptable outage and vulnerability scans verify the intended fixed version.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
- Known authorized boot components load and tampering is detected without losing recovery access.
Explanation
Correct Answer
A:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. The remediation is: Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
Incorrect Answers
B:This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
C:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair.
D:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Disable unused services and secure baseline fault or prove its repair. For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A targeted investigation checks: Compare listening ports, running services, local accounts and policy deviations against the approved baseline. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
Question 490
A change board is planning a verified response to this server event: An application host exposes legacy management protocols and default sample accounts to every subnet. For the Disable unused services and secure baseline issue, which response elements belong in the approved plan? Select TWO answers.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Known authorized boot components load and tampering is detected without losing recovery access.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Explanation
Correct Answer
B:These observations investigate the exact Disable unused services and secure baseline failure rather than unrelated components. The expected technical relationship is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
C:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A successful outcome is: Only documented required services and accounts remain, with functional checks passing after hardening.
Incorrect Answers
A:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Discriminate using: Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
D:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control.
E:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
