cert
cert-1
cert-2

Pass CompTIA SK0-005 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
SK0-005 Exam - Verified By Experts
SK0-005 Premium Bundle
$29.98

SK0-005 Premium Bundle

$79.99
$109.97
  • Premium File 617 Questions & Answers. Last update: Nov 13, 2026
  • Training Course 139 Video Lectures
  • Study Guide 533 Pages
 
$109.97
$79.99
accept 21 downloads in last 7 days
block-screenshots
Purchase CompTIA SK0-005 Exam Training Products Individually
CompTIA SK0-005 Premium File
Premium File 617 Q&A
$76.99$69.99
CompTIA SK0-005 Video Training Course
Training Course 139 Lectures
$21.99 $19.99
CompTIA SK0-005 PDF Study Guide
Study Guide 533 Pages
$21.99 $19.99
CompTIA SK0-005 Practice Test 51

Question 500

A change board is planning a verified response to this server event: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet. For the Host firewall and east-west filtering issue, which response elements belong in the approved plan? Select THREE answers.

  1. Approved application flows work and unrelated lateral movement attempts are denied and logged.
  2. Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
  3. Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.
  4. Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
  5. Disable all firewall rules to fix a single application connection failure.
  6. Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.

Explanation

Correct Answer

A:

A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This evidence tests whether the original Host firewall and east-west filtering weakness has been corrected under realistic conditions.

D:

These observations investigate the exact Host firewall and east-west filtering failure rather than unrelated components. Incident: An administrator resolves one blocked application port by disabling every host firewall profile on the subnet.

F:

A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This is the appropriate targeted correction for Host firewall and east-west filtering.

Incorrect Answers

B:

That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries. This statement concerns Media sanitization by classification, a different Server+ technical control.

C:

That option would inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness, but it addresses a different concern. A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.

E:

Discriminate using: Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.

Question 501

A server administrator is investigating a server issue involving secure boot tpm and hardware root of trust: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
  2. Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
  3. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  4. Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.

Explanation

Correct Answer

B:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Incorrect Answers

A:

That option would apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols, but it addresses a different concern. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

C:

This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

D:

That option would implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations, but it addresses a different concern. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Question 502

While reviewing the CompTIA Server+ administration incident, a technician learns: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. Data-protection controls should follow sensitivity and approved retention; a technically reachable storage bucket is not automatically an authorized destination.
  2. Physical environmental hazards can cause correlated service failures and must be detected before hardware shutdown.
  3. Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.
  4. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Explanation

Correct Answer

D:

The acceptance test is: Known authorized boot components load and tampering is detected without losing recovery access.

Incorrect Answers

A:

This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

B:

This statement concerns Environmental monitoring and suppression, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

C:

This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

Question 503

Before a server change is approved, the on-call engineer receives this incident report: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
  2. Inspect sensor placement, alert thresholds, cooling redundancy, water paths and fire-system maintenance records.
  3. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  4. Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.

Explanation

Correct Answer

D:

These observations investigate the exact Secure Boot TPM and hardware root of trust failure rather than unrelated components. Incident: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning.

Incorrect Answers

A:

For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.

B:

For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

C:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic.

Question 504

After the team implements a targeted remediation for Secure Boot TPM and hardware root of trust, the original incident was: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. Only authorized destinations retain the required minimized data for the approved period, with traceable deletion or archival.
  2. Only documented required services and accounts remain, with functional checks passing after hardening.
  3. An offline or isolated restore point survives a simulated primary-site or administrator compromise.
  4. Known authorized boot components load and tampering is detected without losing recovery access.

Explanation

Correct Answer

D:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Incorrect Answers

A:

This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.

B:

This statement concerns Disable unused services and secure baseline, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

C:

This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

Question 505

A change board is planning a verified response to this server event: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning. For the Secure Boot TPM and hardware root of trust issue, which response elements belong in the approved plan? Select ONE best answer.

  1. Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures. Then validate the change by confirming: Known authorized boot components load and tampering is detected without losing recovery access.
  2. Monitor temperature, humidity, water and fire risks with alarms and approved cooling or suppression response plans.
  3. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  4. Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.

Explanation

Correct Answer

A:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. The proposed change and outcome assessment work together for Secure Boot TPM and hardware root of trust.

Incorrect Answers

B:

That option would monitor temperature, humidity, water and fire risks with alarms and approved cooling or suppression response plans, but it addresses a different concern. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

C:

This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic. Incident: A server's boot chain is tampered with, but integrity checks are disabled to speed up provisioning.

D:

This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

Question 506

A server administrator is investigating a server issue involving secure boot tpm and hardware root of trust: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Test application-consistent restores including data, logs, permissions and integrity at defined intervals.
  2. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  3. Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
  4. Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.

Explanation

Correct Answer

C:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Incorrect Answers

A:

This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

B:

This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic. Incident: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked.

D:

This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

Question 507

While reviewing the CompTIA Server+ administration incident, a technician learns: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
  2. Patch management balances exposure reduction with service continuity using tested change windows and exception handling.
  3. Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.
  4. Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.

Explanation

Correct Answer

C:

The acceptance test is: Known authorized boot components load and tampering is detected without losing recovery access.

Incorrect Answers

A:

This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.

B:

This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

D:

This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.

Question 508

Before a server change is approved, the on-call engineer receives this incident report: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Inspect advisories, dependency matrix, staging test results, maintenance plan and postpatch scans.
  2. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  3. Inspect sensor placement, alert thresholds, cooling redundancy, water paths and fire-system maintenance records.
  4. Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.

Explanation

Correct Answer

D:

These observations investigate the exact Secure Boot TPM and hardware root of trust failure rather than unrelated components. Incident: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked.

Incorrect Answers

A:

For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

B:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

C:

For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. This statement concerns Environmental monitoring and suppression, a different Server+ technical control.

Question 509

After the team implements a targeted remediation for Secure Boot TPM and hardware root of trust, the original incident was: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. A recovered application opens consistent data and passes functional and permission tests at the target restore point.
  2. Known authorized boot components load and tampering is detected without losing recovery access.
  3. Approved application flows work and unrelated lateral movement attempts are denied and logged.
  4. The user completes the approved task without access to unrelated management planes or data.

Explanation

Correct Answer

B:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. This evidence tests whether the original Secure Boot TPM and hardware root of trust weakness has been corrected under realistic conditions.

Incorrect Answers

A:

This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

C:

This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

D:

This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair. For this incident, the relevant principle is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A targeted investigation checks: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness. The desired recovery condition is: Known authorized boot components load and tampering is detected without losing recovery access.

Question 510

A change board is planning a verified response to this server event: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. For the Secure Boot TPM and hardware root of trust issue, which response elements belong in the approved plan? Select TWO answers.

  1. Approved application flows work and unrelated lateral movement attempts are denied and logged.
  2. Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
  3. Disable measured-boot and firmware validation when a suspicious boot change is detected.
  4. Stage vendor-supported security updates, validate application compatibility, keep rollback options and document temporary mitigations.
  5. Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.

Explanation

Correct Answer

B:

Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A successful outcome is: Known authorized boot components load and tampering is detected without losing recovery access.

E:

The expected technical relationship is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.

Incorrect Answers

A:

This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.

C:

This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic. Discriminate using: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.

D:

This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.

CompTIA Server+ Certification Exam (SK0-005) Practice Tests