CompTIA SK0-005 Practice Test 50
Question 490
A change board is planning a verified response to this server event: An application host exposes legacy management protocols and default sample accounts to every subnet. For the Disable unused services and secure baseline issue, which response elements belong in the approved plan? Select TWO answers.
- Leave all default listeners and sample accounts enabled because the perimeter firewall exists.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Known authorized boot components load and tampering is detected without losing recovery access.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Explanation
Correct Answer
B:These observations investigate the exact Disable unused services and secure baseline failure rather than unrelated components. The expected technical relationship is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed.
C:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. A successful outcome is: Only documented required services and accounts remain, with functional checks passing after hardening.
Incorrect Answers
A:Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. Discriminate using: Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
D:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control.
E:For this incident, the relevant principle is: Reducing active attack surface is a practical first line of defense; unused defaults should not remain exposed. The desired recovery condition is: Only documented required services and accounts remain, with functional checks passing after hardening.
Question 491
A server administrator is investigating a server issue involving host firewall and east-west filtering: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
- Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
- Disable all firewall rules to fix a single application connection failure.
Explanation
Correct Answer
A:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Incorrect Answers
B:That option would enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
C:That option would apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
D:This is the unsafe shortcut in the Host firewall and east-west filtering scenario, not a justified remediation or diagnostic. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Question 492
While reviewing the CompTIA Server+ administration incident, a technician learns: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.
- Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
- Physical access can bypass many software controls; identity, escort and audit are needed at equipment boundaries.
- A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Explanation
Correct Answer
D:Applying it leads to this operational action: Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
Incorrect Answers
A:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
B:This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
C:This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
Question 493
Before a server change is approved, the on-call engineer receives this incident report: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inventory service tokens, access scopes, expiration dates, vault access and code-repository leakage.
- Disable all firewall rules to fix a single application connection failure.
- Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
Explanation
Correct Answer
C:These observations investigate the exact Host firewall and east-west filtering failure rather than unrelated components. Incident: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic.
Incorrect Answers
A:For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
B:This is the unsafe shortcut in the Host firewall and east-west filtering scenario, not a justified remediation or diagnostic. Incident: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic.
D:For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Question 494
After the team implements a targeted remediation for Host firewall and east-west filtering, the original incident was: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Clients establish mutually appropriate authenticated encrypted connections with verification enabled.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
- Known authorized boot components load and tampering is detected without losing recovery access.
Explanation
Correct Answer
B:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Incorrect Answers
A:This statement concerns TLS certificate chain and secure transport, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
C:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair.
D:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
Question 495
A change board is planning a verified response to this server event: A compromised web-tier VM can initiate SMB access to all database servers because host firewalls permit any internal traffic. For the Host firewall and east-west filtering issue, which response elements belong in the approved plan? Select ONE best answer.
- Disable all firewall rules to fix a single application connection failure.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations. Then validate the change by confirming: Approved application flows work and unrelated lateral movement attempts are denied and logged.
- Inspect authentication policy, MFA enrollment, privileged-session records and emergency account use.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
Explanation
Correct Answer
B:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. The proposed change and outcome assessment work together for Host firewall and east-west filtering.
Incorrect Answers
A:This is the unsafe shortcut in the Host firewall and east-west filtering scenario, not a justified remediation or diagnostic. Discriminate using: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
C:That option would inspect authentication policy, MFA enrollment, privileged-session records and emergency account use, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
D:That option would use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Question 496
A server administrator is investigating a server issue involving host firewall and east-west filtering: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
- Disable all firewall rules to fix a single application connection failure.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
Explanation
Correct Answer
B:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Incorrect Answers
A:That option would keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
C:This is the unsafe shortcut in the Host firewall and east-west filtering scenario, not a justified remediation or diagnostic. Incident: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet.
D:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
Question 497
While reviewing the CompTIA Server+ administration incident, a technician learns: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Patch management balances exposure reduction with service continuity using tested change windows and exception handling.
- A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Explanation
Correct Answer
B:Applying it leads to this operational action: Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations. This is the controlling principle for the reported Host firewall and east-west filtering incident.
Incorrect Answers
A:This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
C:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
D:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
Question 498
Before a server change is approved, the on-call engineer receives this incident report: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Review classification labels, export audit logs, retention settings, access grants and sample records.
- Inspect advisories, dependency matrix, staging test results, maintenance plan and postpatch scans.
- Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
- Disable all firewall rules to fix a single application connection failure.
Explanation
Correct Answer
C:These observations investigate the exact Host firewall and east-west filtering failure rather than unrelated components. The expected technical relationship is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Incorrect Answers
A:For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This statement concerns Data classification and retention controls, a different Server+ technical control.
B:For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This statement concerns Patching with staged rollback, a different Server+ technical control.
D:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Question 499
After the team implements a targeted remediation for Host firewall and east-west filtering, the original incident was: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- An offline or isolated restore point survives a simulated primary-site or administrator compromise.
- Only documented required services and accounts remain, with functional checks passing after hardening.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- Sensitive data on lost media is protected and authorized recovery still works using controlled key escrow.
Explanation
Correct Answer
C:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
Incorrect Answers
A:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair.
B:This statement concerns Disable unused services and secure baseline, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
D:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Host firewall and east-west filtering fault or prove its repair. For this incident, the relevant principle is: A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. A targeted investigation checks: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports. The desired recovery condition is: Approved application flows work and unrelated lateral movement attempts are denied and logged.
Question 500
A change board is planning a verified response to this server event: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. For the Host firewall and east-west filtering issue, which response elements belong in the approved plan? Select THREE answers.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.
- Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
- Disable all firewall rules to fix a single application connection failure.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
Explanation
Correct Answer
A:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This evidence tests whether the original Host firewall and east-west filtering weakness has been corrected under realistic conditions.
D:These observations investigate the exact Host firewall and east-west filtering failure rather than unrelated components. Incident: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet.
F:A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This is the appropriate targeted correction for Host firewall and east-west filtering.
Incorrect Answers
B:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This statement concerns Media sanitization by classification, a different Server+ technical control.
C:That option would inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
E:Discriminate using: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
