CompTIA SK0-005 Practice Test 53
Question 520
A change board is planning a verified response to this server event: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented. For the Media sanitization by classification issue, which response elements belong in the approved plan? Select TWO answers.
- Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
- Format the filesystem and assume no recoverable customer data remains on the drive.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Prioritize verified vulnerabilities by exploitability, exposure and business impact; apply supported remediations with evidence.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
Explanation
Correct Answer
C:Before rollout, confirm the problem with: Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody. File deletion and reformatting are not equivalent to verified sanitization of residual media data.
E:The expected technical relationship is: File deletion and reformatting are not equivalent to verified sanitization of residual media data. These observations investigate the exact Media sanitization by classification failure rather than unrelated components.
Incorrect Answers
A:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair.
B:Incident: An encrypted storage array is decommissioned, but its key destruction and physical drive disposition are not documented.
D:This statement concerns Vulnerability scanning and prioritization, a different Server+ technical control. It does not directly address the reported Media sanitization by classification fault or prove its repair. For this incident, the relevant principle is: File deletion and reformatting are not equivalent to verified sanitization of residual media data.
Question 521
A server administrator is investigating a server issue involving decommissioning service identities and asset records: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
- Apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols.
Explanation
Correct Answer
C:A successful outcome is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition. This is the appropriate targeted correction for Decommissioning service identities and asset records.
Incorrect Answers
A:That option would apply approved sanitization or cryptographic erase methods appropriate to media and classification, then retain evidence, but it addresses a different concern. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
B:This is the unsafe shortcut in the Decommissioning service identities and asset records scenario, not a justified remediation or diagnostic. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
D:That option would apply a documented hardening baseline, disable unused services/accounts and keep only approved management protocols, but it addresses a different concern. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Question 522
While reviewing the CompTIA Server+ administration incident, a technician learns: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
- Successful data transfer alone does not establish recoverability; services need consistent artifacts and configuration state.
- Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
- Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Explanation
Correct Answer
C:This is the controlling principle for the reported Decommissioning service identities and asset records incident. Applying it leads to this operational action: Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Incorrect Answers
A:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
B:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
D:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Question 523
Before a server change is approved, the on-call engineer receives this incident report: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
- Record media IDs, encryption status, chosen erasure standard, erase results and chain of custody.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
Explanation
Correct Answer
D:These observations investigate the exact Decommissioning service identities and asset records failure rather than unrelated components. Incident: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid.
Incorrect Answers
A:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
B:Instead, the supported correction is: Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle. This is the unsafe shortcut in the Decommissioning service identities and asset records scenario, not a justified remediation or diagnostic.
C:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Question 524
After the team implements a targeted remediation for Decommissioning service identities and asset records, the original incident was: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Only documented required services and accounts remain, with functional checks passing after hardening.
- Only authorized destinations retain the required minimized data for the approved period, with traceable deletion or archival.
- An offline or isolated restore point survives a simulated primary-site or administrator compromise.
- Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Explanation
Correct Answer
D:Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Incorrect Answers
A:This statement concerns Disable unused services and secure baseline, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
B:This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
C:This statement concerns Immutable and offsite backup strategy, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair.
Question 525
A change board is planning a verified response to this server event: A retired server is physically removed but its monitoring agent certificate and domain computer account remain valid. For the Decommissioning service identities and asset records issue, which response elements belong in the approved plan? Select ONE best answer.
- Measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle. Then validate the change by confirming: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
Explanation
Correct Answer
C:This avoids the unsafe shortcut: Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
Incorrect Answers
A:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. This statement concerns RPO and RTO-driven disaster recovery, a different Server+ technical control.
B:Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. This is the unsafe shortcut in the Decommissioning service identities and asset records scenario, not a justified remediation or diagnostic.
D:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control.
Question 526
A server administrator is investigating a server issue involving decommissioning service identities and asset records: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
- Enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures.
- Use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
Explanation
Correct Answer
A:A successful outcome is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Incorrect Answers
B:That option would enable supported Secure Boot and TPM-backed integrity or key protection with verified recovery procedures, but it addresses a different concern. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
C:That option would use narrowly scoped managed identities or service accounts and protect, rotate and revoke their secrets using approved storage, but it addresses a different concern. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
D:This is the unsafe shortcut in the Decommissioning service identities and asset records scenario, not a justified remediation or diagnostic. Incident: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later.
Question 527
While reviewing the CompTIA Server+ administration incident, a technician learns: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Nonhuman identities are privileged principals; service convenience does not justify permanent broad permissions or exposed credentials.
- RTO measures acceptable service restoration time; RPO measures acceptable data loss, and they drive different design choices.
- Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
- Trust in the operating system begins before it starts; firmware and measured boot support protection against boot-level changes.
Explanation
Correct Answer
C:This is the controlling principle for the reported Decommissioning service identities and asset records incident. The acceptance test is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Incorrect Answers
A:This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
B:This statement concerns RPO and RTO-driven disaster recovery, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
D:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Question 528
Before a server change is approved, the on-call engineer receives this incident report: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Review door events, camera footage, approved visitor roster, rack locks and access recertification.
- Measure actual restore durations, last consistent recovery points, dependencies and recovery staff availability.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
Explanation
Correct Answer
C:These observations investigate the exact Decommissioning service identities and asset records failure rather than unrelated components. Incident: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later.
Incorrect Answers
A:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
B:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
D:Instead, the supported correction is: Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Question 529
After the team implements a targeted remediation for Decommissioning service identities and asset records, the original incident was: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Automated jobs work with minimum permissions and leaked or expired credentials are no longer usable.
- Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
- A controlled simulated environmental warning reaches responders in time and temperature stays within equipment range.
Explanation
Correct Answer
B:Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Incorrect Answers
A:This statement concerns Service-account secret rotation and scope, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair.
C:This statement concerns Media sanitization by classification, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
D:This statement concerns Environmental monitoring and suppression, a different Server+ technical control. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair. For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. A targeted investigation checks: Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions. The desired recovery condition is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition.
Question 530
A change board is planning a verified response to this server event: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. For the Decommissioning service identities and asset records issue, which response elements belong in the approved plan? Select TWO answers.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
- Select recovery architecture to meet quantified RTO and RPO, then validate both during controlled recovery exercises.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Explanation
Correct Answer
D:These observations investigate the exact Decommissioning service identities and asset records failure rather than unrelated components. The expected technical relationship is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
E:A successful outcome is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Incorrect Answers
A:Instead, the supported correction is: Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
B:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. This statement concerns Media sanitization by classification, a different Server+ technical control.
C:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair.
