CompTIA SK0-005 Practice Test 77
Question 760
A change board is planning a verified response to this server event: A new static route points through a decommissioned router, producing one-way connectivity to the backup network. For the Routing and stateful firewall asymmetry issue, which response elements belong in the approved plan? Select TWO answers.
- Disable every stateful inspection rule because one route is asymmetric.
- Affected clients resolve the correct application endpoint and connect consistently.
- Trace route tables, firewall session logs, interface captures and asymmetric path metrics.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
- Inspect forward/return routing, gateway selection and stateful firewall rules; correct the narrow route or policy.
Explanation
Correct Answer
C:These observations investigate the exact Routing and stateful firewall asymmetry failure rather than unrelated components. Confirm remediation through: Connections complete through approved paths in both directions without broad firewall bypasses.
E:Reachability requires valid bidirectional paths and compatible state tracking, not only an outbound SYN packet.
Incorrect Answers
A:Discriminate using: Trace route tables, firewall session logs, interface captures and asymmetric path metrics.
B:For this incident, the relevant principle is: Reachability requires valid bidirectional paths and compatible state tracking, not only an outbound SYN packet. This statement concerns DNS client-specific failure, a different Server+ technical control.
D:For this incident, the relevant principle is: Reachability requires valid bidirectional paths and compatible state tracking, not only an outbound SYN packet. The desired recovery condition is: Connections complete through approved paths in both directions without broad firewall bypasses.
Question 761
A server administrator is investigating a server issue involving brute-force authentication and account lockout: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
- Inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
Explanation
Correct Answer
D:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A successful outcome is: Malicious login attempts are contained without losing authorized administrative access.
Incorrect Answers
A:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
B:This is the unsafe shortcut in the Brute-force authentication and account lockout scenario, not a justified remediation or diagnostic. Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
C:That option would inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates, but it addresses a different concern. Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Question 762
While reviewing the CompTIA Server+ administration incident, a technician learns: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Name resolution failures should be isolated from transport connectivity by comparing direct IP and DNS queries.
- Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
- Power redundancy requires end-to-end capacity and isolation, not merely green status indicators on redundant modules.
- Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Explanation
Correct Answer
B:Applying it leads to this operational action: Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials. The acceptance test is: Malicious login attempts are contained without losing authorized administrative access.
Incorrect Answers
A:This statement concerns DNS client-specific failure, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
C:This statement concerns PSU and power event isolation, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
D:This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
Question 763
Before a server change is approved, the on-call engineer receives this incident report: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
- Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
- Collect handshake diagnostics, SAN/issuer fields, trust store configuration and date/time status.
Explanation
Correct Answer
A:These observations investigate the exact Brute-force authentication and account lockout failure rather than unrelated components. The expected technical relationship is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Incorrect Answers
B:This is the unsafe shortcut in the Brute-force authentication and account lockout scenario, not a justified remediation or diagnostic. Discriminate using: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
C:For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
D:For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. This statement concerns Expired certificate and trust failure triage, a different Server+ technical control.
Question 764
After the team implements a targeted remediation for Brute-force authentication and account lockout, the original incident was: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- The observed fault is reproduced, a single corrective change resolves it and the rollback and final state are documented.
- Malicious login attempts are contained without losing authorized administrative access.
- Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
- The host survives the designed single-power-path failure without reset or overcurrent.
Explanation
Correct Answer
B:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Incorrect Answers
A:This statement concerns Structured troubleshooting hypothesis and controlled change, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
C:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
D:This statement concerns PSU and power event isolation, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
Question 765
A change board is planning a verified response to this server event: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts. For the Brute-force authentication and account lockout issue, which response elements belong in the approved plan? Select ONE best answer.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
- Examine controller cache mode, BBU/flash status, workload write latency and vendor alerts.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials. Then validate the change by confirming: Malicious login attempts are contained without losing authorized administrative access.
Explanation
Correct Answer
D:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. The proposed change and outcome assessment work together for Brute-force authentication and account lockout.
Incorrect Answers
A:This is the unsafe shortcut in the Brute-force authentication and account lockout scenario, not a justified remediation or diagnostic. Incident: A public remote desktop listener receives thousands of failed logins and begins locking legitimate support accounts.
B:This statement concerns Write cache battery and storage performance, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
C:This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
Question 766
A server administrator is investigating a server issue involving brute-force authentication and account lockout: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
- Collect time-synchronized logs, hardware alerts and relevant volatile evidence according to incident procedures before destructive action.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
- Identify whether blocks, inodes, quotas or reserved space is exhausted; reclaim or expand only the constrained resource.
Explanation
Correct Answer
A:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Incorrect Answers
B:This statement concerns Log correlation and evidence preservation, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
C:This is the unsafe shortcut in the Brute-force authentication and account lockout scenario, not a justified remediation or diagnostic. Incident: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold.
D:That option would identify whether blocks, inodes, quotas or reserved space is exhausted; reclaim or expand only the constrained resource, but it addresses a different concern. Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Question 767
While reviewing the CompTIA Server+ administration incident, a technician learns: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Link-up alone does not establish link quality; CRC, FCS, drops and duplex mismatches reveal layer-one or layer-two faults.
- Evidence quality depends on provenance, timing and preservation, not only the volume of screenshots taken after recovery.
- Filesystem write failures can arise from inode or quota limits as well as free-block exhaustion.
- Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Explanation
Correct Answer
D:Applying it leads to this operational action: Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
Incorrect Answers
A:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
B:This statement concerns Log correlation and evidence preservation, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
C:This statement concerns Filesystem full, inode exhaustion and quotas, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
Question 768
Before a server change is approved, the on-call engineer receives this incident report: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
- Inspect interface counters at both ends, cable tests, transceiver diagnostics and negotiated parameters.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
Explanation
Correct Answer
D:These observations investigate the exact Brute-force authentication and account lockout failure rather than unrelated components. Incident: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold.
Incorrect Answers
A:For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
B:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
C:For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control.
Question 769
After the team implements a targeted remediation for Brute-force authentication and account lockout, the original incident was: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- Sustained stress tests run within component thermal limits without unexpected throttling or shutdown.
- The affected application can write while block, inode and quota headroom meet policy.
- Malicious login attempts are contained without losing authorized administrative access.
Explanation
Correct Answer
D:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
Incorrect Answers
A:This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
B:This statement concerns Thermal shutdown and heatsink diagnostics, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. A targeted investigation checks: Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges. The desired recovery condition is: Malicious login attempts are contained without losing authorized administrative access.
C:This statement concerns Filesystem full, inode exhaustion and quotas, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
Question 770
A change board is planning a verified response to this server event: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. For the Brute-force authentication and account lockout issue, which response elements belong in the approved plan? Select TWO answers.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
- Resolve physical media and negotiated speed/duplex compatibility, replacing defective optics or cabling as evidence dictates.
- Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
Explanation
Correct Answer
A:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. This is the appropriate targeted correction for Brute-force authentication and account lockout.
D:These observations investigate the exact Brute-force authentication and account lockout failure rather than unrelated components. Confirm remediation through: Malicious login attempts are contained without losing authorized administrative access.
Incorrect Answers
B:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
C:This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
E:Incident: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold.
