CompTIA SK0-005 Practice Test 60
Question 590
A change board is planning a verified response to this server event: An administrator reboots a compromised machine and clears its logs before recording timestamps and network connections. For the Log correlation and evidence preservation issue, which response elements belong in the approved plan? Select TWO answers.
- Correlate ECC and memory training events with physical slots, then replace faulty qualified DIMMs using approved service steps.
- Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
- Delete event logs and reboot repeatedly before collecting any useful failure evidence.
- Correlate system, application, hypervisor and switch events using aligned timestamps and event identifiers.
- Collect time-synchronized logs, hardware alerts and relevant volatile evidence according to incident procedures before destructive action.
Explanation
Correct Answer
D:These observations investigate the exact Log correlation and evidence preservation failure rather than unrelated components. Confirm remediation through: A traceable incident timeline identifies the failing component or service without destroying relevant records.
E:Evidence quality depends on provenance, timing and preservation, not only the volume of screenshots taken after recovery. For this case, An administrator reboots a compromised machine and clears its logs before recording timestamps and network connections.
Incorrect Answers
A:For this incident, the relevant principle is: Evidence quality depends on provenance, timing and preservation, not only the volume of screenshots taken after recovery. The desired recovery condition is: A traceable incident timeline identifies the failing component or service without destroying relevant records.
B:For this incident, the relevant principle is: Evidence quality depends on provenance, timing and preservation, not only the volume of screenshots taken after recovery. This statement concerns Escalation, rollback and post-incident closure, a different Server+ technical control.
C:Discriminate using: Correlate system, application, hypervisor and switch events using aligned timestamps and event identifiers.
Question 591
A server administrator is investigating a server issue involving escalation, rollback and post-incident closure: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Record symptoms and recent changes, form a testable hypothesis, change one variable at a time and preserve rollback evidence.
- Collect time-synchronized logs, hardware alerts and relevant volatile evidence according to incident procedures before destructive action.
- Leave emergency security bypasses permanent because the application now responds.
- Escalate using evidence and severity thresholds, apply a reversible supported workaround and remove temporary exceptions after root-cause review.
Explanation
Correct Answer
D:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. For this case, A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA.
Incorrect Answers
A:That option would record symptoms and recent changes, form a testable hypothesis, change one variable at a time and preserve rollback evidence, but it addresses a different concern. Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
B:This statement concerns Log correlation and evidence preservation, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
C:This is the unsafe shortcut in the Escalation, rollback and post-incident closure scenario, not a justified remediation or diagnostic. Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
Question 592
While reviewing the CompTIA Server+ administration incident, a technician learns: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Tagged VLAN traffic must be permitted end-to-end; routing changes do not repair a missing layer-two VLAN path.
- Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
- Link-up alone does not establish link quality; CRC, FCS, drops and duplex mismatches reveal layer-one or layer-two faults.
- Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Explanation
Correct Answer
B:The acceptance test is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Incorrect Answers
A:This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
C:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
D:This statement concerns Brute-force authentication and account lockout, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Question 593
Before a server change is approved, the on-call engineer receives this incident report: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Correlate system, application, hypervisor and switch events using aligned timestamps and event identifiers.
- Inspect switchport mode, native VLAN, allowed VLAN set, MAC learning and packet tags on the affected uplink.
- Leave emergency security bypasses permanent because the application now responds.
- Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
Explanation
Correct Answer
D:These observations investigate the exact Escalation, rollback and post-incident closure failure rather than unrelated components. Incident: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA.
Incorrect Answers
A:For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
B:For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. Incident: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA.
C:This is the unsafe shortcut in the Escalation, rollback and post-incident closure scenario, not a justified remediation or diagnostic. Incident: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA.
Question 594
After the team implements a targeted remediation for Escalation, rollback and post-incident closure, the original incident was: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Connections complete through approved paths in both directions without broad firewall bypasses.
- Malicious login attempts are contained without losing authorized administrative access.
- Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
- The observed fault is reproduced, a single corrective change resolves it and the rollback and final state are documented.
Explanation
Correct Answer
C:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. Incident: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA.
Incorrect Answers
A:This statement concerns Routing and stateful firewall asymmetry, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
B:This statement concerns Brute-force authentication and account lockout, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair.
D:This statement concerns Structured troubleshooting hypothesis and controlled change, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Question 595
A change board is planning a verified response to this server event: A technician tries unsupported registry edits for hours instead of escalating a widespread storage outage to the vendor within SLA. For the Escalation, rollback and post-incident closure issue, which response elements belong in the approved plan? Select ONE best answer.
- Correct access/trunk VLAN membership and allowed VLAN lists while preserving intended segmentation.
- Escalate using evidence and severity thresholds, apply a reversible supported workaround and remove temporary exceptions after root-cause review. Then validate the change by confirming: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
- Capture MPIO path health, initiator sessions, SAN switch errors and storage-array controller port statistics.
- Leave emergency security bypasses permanent because the application now responds.
Explanation
Correct Answer
B:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. This avoids the unsafe shortcut: Leave emergency security bypasses permanent because the application now responds.
Incorrect Answers
A:This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair.
C:This statement concerns SAN fabric multipath failover and latency, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
D:This is the unsafe shortcut in the Escalation, rollback and post-incident closure scenario, not a justified remediation or diagnostic. Discriminate using: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
Question 596
A server administrator is investigating a server issue involving escalation, rollback and post-incident closure: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Restore the supported boot entry or known-good kernel and rebuild boot images as needed using tested recovery media.
- Escalate using evidence and severity thresholds, apply a reversible supported workaround and remove temporary exceptions after root-cause review.
- Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
- Leave emergency security bypasses permanent because the application now responds.
Explanation
Correct Answer
B:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. For this case, A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
Incorrect Answers
A:This statement concerns Boot loader and failed update recovery, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
C:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
D:This is the unsafe shortcut in the Escalation, rollback and post-incident closure scenario, not a justified remediation or diagnostic. Incident: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
Question 597
While reviewing the CompTIA Server+ administration incident, a technician learns: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.
- Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
- Boot failures may arise before services start; distinguish firmware/bootloader problems from application outages.
- Write-back caching requires reliable protected power or flash persistence; disabling cache can raise latency for safety.
Explanation
Correct Answer
B:The acceptance test is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Incorrect Answers
A:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair.
C:This statement concerns Boot loader and failed update recovery, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair.
D:This statement concerns Write cache battery and storage performance, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Question 598
Before a server change is approved, the on-call engineer receives this incident report: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Leave emergency security bypasses permanent because the application now responds.
- Examine controller cache mode, BBU/flash status, workload write latency and vendor alerts.
- Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
Explanation
Correct Answer
C:These observations investigate the exact Escalation, rollback and post-incident closure failure rather than unrelated components. Incident: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
Incorrect Answers
A:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
B:For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. Incident: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
D:For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. This statement concerns Brute-force authentication and account lockout, a different Server+ technical control.
Question 599
After the team implements a targeted remediation for Escalation, rollback and post-incident closure, the original incident was: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- A traceable incident timeline identifies the failing component or service without destroying relevant records.
- The host survives the designed single-power-path failure without reset or overcurrent.
- The host boots the approved OS reliably through several cold boots with disk access intact.
- Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Explanation
Correct Answer
D:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. Incident: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
Incorrect Answers
A:This statement concerns Log correlation and evidence preservation, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
B:This statement concerns PSU and power event isolation, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
C:This statement concerns Boot loader and failed update recovery, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
Question 600
A change board is planning a verified response to this server event: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure. For the Escalation, rollback and post-incident closure issue, which response elements belong in the approved plan? Select THREE answers.
- Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
- Capture baseline symptoms, timeline, recent changes, comparison hosts and test results before modifying production.
- Leave emergency security bypasses permanent because the application now responds.
- Escalate using evidence and severity thresholds, apply a reversible supported workaround and remove temporary exceptions after root-cause review.
- Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
- Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
Explanation
Correct Answer
D:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A successful outcome is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
E:These observations investigate the exact Escalation, rollback and post-incident closure failure rather than unrelated components. The expected technical relationship is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
F:Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. This evidence tests whether the original Escalation, rollback and post-incident closure weakness has been corrected under realistic conditions.
Incorrect Answers
A:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor.
B:This statement concerns Structured troubleshooting hypothesis and controlled change, a different Server+ technical control. It does not directly address the reported Escalation, rollback and post-incident closure fault or prove its repair. For this incident, the relevant principle is: Incident resolution includes timely escalation, safe rollback and documented follow-through, not just a green monitor. A targeted investigation checks: Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence. The desired recovery condition is: Service is restored within response targets, temporary risk is removed and a reproducible fix is documented.
C:Incident: A temporary firewall bypass restores a web service but remains undocumented and exposed after incident closure.
