CompTIA SK0-005 Practice Test 52
Question 510
A change board is planning a verified response to this server event: A planned OS encryption deployment fails because TPM firmware, recovery-key handling and Secure Boot requirements were never checked. For the Secure Boot TPM and hardware root of trust issue, which response elements belong in the approved plan? Select TWO answers.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
- Disable measured-boot and firmware validation when a suspicious boot change is detected.
- Stage vendor-supported security updates, validate application compatibility, keep rollback options and document temporary mitigations.
- Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.
Explanation
Correct Answer
B:Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes. A successful outcome is: Known authorized boot components load and tampering is detected without losing recovery access.
E:The expected technical relationship is: Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.
Incorrect Answers
A:This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.
C:This is the unsafe shortcut in the Secure Boot TPM and hardware root of trust scenario, not a justified remediation or diagnostic. Discriminate using: Inspect Secure Boot signatures, TPM state, PCR or attestation reports and key-recovery readiness.
D:This statement concerns Patching with staged rollback, a different Server+ technical control. It does not directly address the reported Secure Boot TPM and hardware root of trust fault or prove its repair.
Question 511
A server administrator is investigating a server issue involving media sanitization by classification: Retired disks from a customer database are sold without sanitization because the server's files were deleted first. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Prioritize verified vulnerabilities by exploitability, exposure and business impact; apply supported remediations with evidence.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Explanation
Correct Answer
A:Before rollout, confirm the problem with: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. For this case, Retired disks from a customer database are sold without sanitization because the server's files were deleted first.
Incorrect Answers
B:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
C:This is the unsafe shortcut in the Media sanitization by classification scenario, not a justified remediation or diagnostic. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
D:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Question 512
While reviewing the CompTIA Server+ administration incident, a technician learns: Retired disks from a customer database are sold without sanitization because the server's files were deleted first. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
- Recovery is a dependency graph, not a collection of powered-on VMs; failback can require careful data reconciliation.
- Password knowledge alone is weak proof of administrator identity; emergency access needs protected exceptions and traceability.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Explanation
Correct Answer
D:Applying it leads to this operational action: Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
Incorrect Answers
A:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
B:This statement concerns Site failover dependencies and failback, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
C:This statement concerns MFA and just-in-time administration, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Question 513
Before a server change is approved, the on-call engineer receives this incident report: Retired disks from a customer database are sold without sanitization because the server's files were deleted first. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
Explanation
Correct Answer
A:The expected technical relationship is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Incorrect Answers
B:For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. This statement concerns Decommissioning service identities and asset records, a different Server+ technical control.
C:This is the unsafe shortcut in the Media sanitization by classification scenario, not a justified remediation or diagnostic. Incident: Retired disks from a customer database are sold without sanitization because the server's files were deleted first.
D:For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
Question 514
After the team implements a targeted remediation for Media sanitization by classification, the original incident was: Retired disks from a customer database are sold without sanitization because the server's files were deleted first. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Highest-risk reachable vulnerabilities are remediated or formally mitigated, then rescans confirm closure.
- Users complete critical transactions in the alternate site, and a rehearsed failback restores a consistent primary.
- Approved application flows work and unrelated lateral movement attempts are denied and logged.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Explanation
Correct Answer
D:File deletion and reformatting are not equivalent to verified sanitization of residual media data. Incident: Retired disks from a customer database are sold without sanitization because the server's files were deleted first.
Incorrect Answers
A:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair.
B:This statement concerns Site failover dependencies and failback, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair.
C:This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Question 515
A change board is planning a verified response to this server event: Retired disks from a customer database are sold without sanitization because the server's files were deleted first. For the Media sanitization by classification issue, which response elements belong in the approved plan? Select ONE best answer.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence. Then validate the change by confirming: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Explanation
Correct Answer
D:Before modifying systems, gather: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
Incorrect Answers
A:This is the unsafe shortcut in the Media sanitization by classification scenario, not a justified remediation or diagnostic. Discriminate using: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
B:That option would enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy, but it addresses a different concern. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
C:That option would compare listening ports, running services, local accounts and policy deviations against the approved baseline, but it addresses a different concern. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Question 516
A server administrator is investigating a server issue involving media sanitization by classification: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
- Test application-consistent restores including data, logs, permissions and integrity at defined intervals.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
Explanation
Correct Answer
D:Before rollout, confirm the problem with: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. For this case, An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented.
Incorrect Answers
A:This is the unsafe shortcut in the Media sanitization by classification scenario, not a justified remediation or diagnostic. Incident: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented.
B:That option would grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews, but it addresses a different concern. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
C:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
Question 517
While reviewing the CompTIA Server+ administration incident, a technician learns: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.
- File deletion and reformatting are not equivalent to verified sanitization of residual media data.
- Risk-based remediation combines technical severity and local exposure; score alone does not establish operational priority.
- Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.
Explanation
Correct Answer
B:Applying it leads to this operational action: Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
Incorrect Answers
A:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
C:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
D:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair.
Question 518
Before a server change is approved, the on-call engineer receives this incident report: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Compare listening ports, running services, local accounts and policy deviations against the approved baseline.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Check asset exposure, affected software versions, exploit availability, scan confidence and compensating controls.
Explanation
Correct Answer
B:The expected technical relationship is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Incorrect Answers
A:For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
C:File deletion and reformatting are not equivalent to verified sanitization of residual media data.
D:For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control.
Question 519
After the team implements a targeted remediation for Media sanitization by classification, the original incident was: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
- Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
Explanation
Correct Answer
C:File deletion and reformatting are not equivalent to verified sanitization of residual media data. Incident: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented.
Incorrect Answers
A:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
B:This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. A targeted investigation checks: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. The desired recovery condition is: Decommissioned media has verifiable sanitization or destruction evidence matching policy.
D:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Question 520
A change board is planning a verified response to this server event: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. For the Media sanitization by classification issue, which response elements belong in the approved plan? Select TWO answers.
- Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Prioritize verified vulnerabilities by exploitability, exposure and business impact; apply supported remediations with evidence.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
Explanation
Correct Answer
C:Before rollout, confirm the problem with: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
E:The expected technical relationship is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. These observations investigate the exact Media sanitization by classification failure rather than unrelated components.
Incorrect Answers
A:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair.
B:Incident: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented.
D:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
