CompTIA SK0-005 Practice Test 54
Question 530
A change board is planning a verified response to this server event: A decommissioned virtual host still owns firewall exceptions, DNS records and an API token used by attackers months later. For the Decommissioning service identities and asset records issue, which response elements belong in the approved plan? Select TWO answers.
- Delete the VM image while leaving associated keys, firewall rules and service accounts enabled.
- Decommissioned media has verifiable sanitization or destruction evidence matching policy.
- Select recovery architecture to meet quantified RTO and RPO, then validate both during controlled recovery exercises.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
Explanation
Correct Answer
D:These observations investigate the exact Decommissioning service identities and asset records failure rather than unrelated components. The expected technical relationship is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
E:A successful outcome is: Retired assets cannot authenticate or receive traffic and records accurately show the disposition. Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
Incorrect Answers
A:Instead, the supported correction is: Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
B:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. This statement concerns Media sanitization by classification, a different Server+ technical control.
C:For this incident, the relevant principle is: Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware. It does not directly address the reported Decommissioning service identities and asset records fault or prove its repair.
Question 531
A server administrator is investigating a server issue involving immutable and offsite backup strategy: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
- Classify sensitive records and enforce least-necessary access, approved retention and controlled export or redaction.
- Test application-consistent restores including data, logs, permissions and integrity at defined intervals.
- Store all backups on the production server with the same administrator credentials.
Explanation
Correct Answer
A:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Incorrect Answers
B:This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
C:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
D:This is the unsafe shortcut in the Immutable and offsite backup strategy scenario, not a justified remediation or diagnostic. Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Question 532
While reviewing the CompTIA Server+ administration incident, a technician learns: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Decommissioning includes logical trust and configuration removal, not just powering off and discarding hardware.
- Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.
- Physical access can bypass many software controls; identity, escort and audit are needed at equipment boundaries.
- Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Explanation
Correct Answer
D:Applying it leads to this operational action: Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
Incorrect Answers
A:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
B:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
C:This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
Question 533
Before a server change is approved, the on-call engineer receives this incident report: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Review backup job logs, quiesce/VSS status, restore checksums, ACLs and test-start results.
- Inventory host identities, DNS, monitoring, backup schedules, service tokens and firewall exceptions.
- Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
- Store all backups on the production server with the same administrator credentials.
Explanation
Correct Answer
C:These observations investigate the exact Immutable and offsite backup strategy failure rather than unrelated components. Incident: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials.
Incorrect Answers
A:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
B:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. This statement concerns Decommissioning service identities and asset records, a different Server+ technical control.
D:This is the unsafe shortcut in the Immutable and offsite backup strategy scenario, not a justified remediation or diagnostic. Incident: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials.
Question 534
After the team implements a targeted remediation for Immutable and offsite backup strategy, the original incident was: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Only authorized destinations retain the required minimized data for the approved period, with traceable deletion or archival.
- Every access to sensitive equipment has valid authorization and traceable access records.
- Known authorized boot components load and tampering is detected without losing recovery access.
- An offline or isolated restore point survives a simulated primary-site or administrator compromise.
Explanation
Correct Answer
D:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Incorrect Answers
A:This statement concerns Data classification and retention controls, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair.
B:This statement concerns Data center physical access enforcement, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair.
C:This statement concerns Secure Boot TPM and hardware root of trust, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
Question 535
A change board is planning a verified response to this server event: A ransomware incident encrypts production data and the only online backup share because both use the same privileged credentials. For the Immutable and offsite backup strategy issue, which response elements belong in the approved plan? Select ONE best answer.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention. Then validate the change by confirming: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
- Inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access.
- Revoke retired host credentials, certificates and network access, remove dependent records and close the asset lifecycle.
- Store all backups on the production server with the same administrator credentials.
Explanation
Correct Answer
A:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. The proposed change and outcome assessment work together for Immutable and offsite backup strategy.
Incorrect Answers
B:That option would inspect storage encryption status, backup-media handling, key custody, access logs and tested recovery access, but it addresses a different concern. Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
C:This statement concerns Decommissioning service identities and asset records, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair.
D:This is the unsafe shortcut in the Immutable and offsite backup strategy scenario, not a justified remediation or diagnostic. Discriminate using: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
Question 536
A server administrator is investigating a server issue involving immutable and offsite backup strategy: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy.
- Store all backups on the production server with the same administrator credentials.
- Grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
Explanation
Correct Answer
D:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. This is the appropriate targeted correction for Immutable and offsite backup strategy.
Incorrect Answers
A:That option would enable appropriate data-at-rest encryption with separated, access-controlled key storage, recovery procedures and rotation policy, but it addresses a different concern. Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
B:This is the unsafe shortcut in the Immutable and offsite backup strategy scenario, not a justified remediation or diagnostic. Incident: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy.
C:That option would grant narrowly scoped roles and use separate privileged identities with periodic entitlement reviews, but it addresses a different concern. Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Question 537
While reviewing the CompTIA Server+ administration incident, a technician learns: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
- Least privilege limits blast radius by granting only the operations each role needs, not broad administrator rights.
- A trusted internal network is not equivalent to all traffic being authorized; east-west access needs explicit boundaries.
- File permissions do not protect stolen offline media; encryption's value depends on safeguarding keys and recoverability.
Explanation
Correct Answer
A:Applying it leads to this operational action: Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention. This is the controlling principle for the reported Immutable and offsite backup strategy incident.
Incorrect Answers
B:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
C:This statement concerns Host firewall and east-west filtering, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
D:This statement concerns Encryption at rest and key lifecycle, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
Question 538
Before a server change is approved, the on-call engineer receives this incident report: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Capture denied flows, review service dependency map, evaluate host firewall rule precedence and test expected ports.
- Inspect advisories, dependency matrix, staging test results, maintenance plan and postpatch scans.
- Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
- Store all backups on the production server with the same administrator credentials.
Explanation
Correct Answer
C:These observations investigate the exact Immutable and offsite backup strategy failure rather than unrelated components. The expected technical relationship is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Incorrect Answers
A:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. This statement concerns Host firewall and east-west filtering, a different Server+ technical control.
B:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. This statement concerns Patching with staged rollback, a different Server+ technical control.
D:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Question 539
After the team implements a targeted remediation for Immutable and offsite backup strategy, the original incident was: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
- An offline or isolated restore point survives a simulated primary-site or administrator compromise.
- Only documented required services and accounts remain, with functional checks passing after hardening.
- The user completes the approved task without access to unrelated management planes or data.
Explanation
Correct Answer
B:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Incorrect Answers
A:This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
C:This statement concerns Disable unused services and secure baseline, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair. For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. A targeted investigation checks: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness. The desired recovery condition is: An offline or isolated restore point survives a simulated primary-site or administrator compromise.
D:This statement concerns RBAC and privileged separation, a different Server+ technical control. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair.
Question 540
A change board is planning a verified response to this server event: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy. For the Immutable and offsite backup strategy issue, which response elements belong in the approved plan? Select TWO answers.
- Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
- Store all backups on the production server with the same administrator credentials.
- A recovered application opens consistent data and passes functional and permission tests at the target restore point.
- Implement least-privilege host or microsegmentation policies allowing documented source, destination and service combinations.
- Keep independent, access-isolated and preferably immutable/offsite backup copies with monitored schedules and retention.
Explanation
Correct Answer
A:These observations investigate the exact Immutable and offsite backup strategy failure rather than unrelated components. Incident: A branch office keeps three backup copies on one RAID array and calls this a full 3-2-1 strategy.
E:Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies.
Incorrect Answers
B:Discriminate using: Inspect backup targets, credential separation, immutability, offsite status and restore-point freshness.
C:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. This statement concerns Application-consistent restore and integrity testing, a different Server+ technical control.
D:For this incident, the relevant principle is: Backup resilience requires separation of failure and credential domains; multiple files on one failure domain are not independent copies. It does not directly address the reported Immutable and offsite backup strategy fault or prove its repair.
