CompTIA SK0-005 Practice Test 78
Question 770
A change board is planning a verified response to this server event: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold. For the Brute-force authentication and account lockout issue, which response elements belong in the approved plan? Select TWO answers.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
- Resolve physical media and negotiated speed/duplex compatibility, replacing defective optics or cabling as evidence dictates.
- Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
- Disable account lockouts and MFA to stop help-desk tickets caused by attackers.
Explanation
Correct Answer
A:Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls. This is the appropriate targeted correction for Brute-force authentication and account lockout.
D:These observations investigate the exact Brute-force authentication and account lockout failure rather than unrelated components. Confirm remediation through: Malicious login attempts are contained without losing authorized administrative access.
Incorrect Answers
B:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair.
C:This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Brute-force authentication and account lockout fault or prove its repair. For this incident, the relevant principle is: Repeated authentication failures across accounts require identity threat response and management-plane restriction, not weakened lockout controls.
E:Incident: A management portal shows password-spray attempts across many users while operators only increase the account lockout threshold.
Question 771
A server administrator is investigating a server issue involving malware persistence and containment: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
- Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
Explanation
Correct Answer
D:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Incorrect Answers
A:That option would inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates, but it addresses a different concern. Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
B:This is the unsafe shortcut in the Malware persistence and containment scenario, not a justified remediation or diagnostic. Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
C:This statement concerns Brute-force authentication and account lockout, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
Question 772
While reviewing the CompTIA Server+ administration incident, a technician learns: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Thermal throttling and protective shutdown may result from heat transfer or airflow faults even without high average CPU use.
- Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.
- Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
- Link-up alone does not establish link quality; CRC, FCS, drops and duplex mismatches reveal layer-one or layer-two faults.
Explanation
Correct Answer
C:Applying it leads to this operational action: Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation. This is the controlling principle for the reported Malware persistence and containment incident.
Incorrect Answers
A:This statement concerns Thermal shutdown and heatsink diagnostics, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
B:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
D:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
Question 773
Before a server change is approved, the on-call engineer receives this incident report: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
- Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
- Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.
Explanation
Correct Answer
C:The expected technical relationship is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. These observations investigate the exact Malware persistence and containment failure rather than unrelated components.
Incorrect Answers
A:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
B:This is the unsafe shortcut in the Malware persistence and containment scenario, not a justified remediation or diagnostic. Discriminate using: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
D:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control.
Question 774
After the team implements a targeted remediation for Malware persistence and containment, the original incident was: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- Authenticated TLS succeeds from all expected clients without disabling validation.
- Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- The array returns to a healthy redundant state with error-free checks and a verified recovery copy.
- Transfer throughput and latency recover while physical error counters remain stable.
Explanation
Correct Answer
B:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. The remediation is: Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
Incorrect Answers
A:This statement concerns Expired certificate and trust failure triage, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
C:This statement concerns RAID degraded state and predictive drive failure, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
D:This statement concerns NIC port errors and duplex mismatch, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair.
Question 775
A change board is planning a verified response to this server event: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence. For the Malware persistence and containment issue, which response elements belong in the approved plan? Select ONE best answer.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation. Then validate the change by confirming: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
- Check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence.
Explanation
Correct Answer
A:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. This avoids the unsafe shortcut: Disable endpoint protection alerts while leaving unknown startup tasks running.
Incorrect Answers
B:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair.
C:This is the unsafe shortcut in the Malware persistence and containment scenario, not a justified remediation or diagnostic. Incident: A file server continues launching an unknown scheduled task after each reboot and its endpoint tool reports suspicious persistence.
D:That option would check outage severity, vendor case criteria, change ticket, workaround expiry and root cause evidence, but it addresses a different concern. Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Question 776
A server administrator is investigating a server issue involving malware persistence and containment: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.
- Correct access/trunk VLAN membership and allowed VLAN lists while preserving intended segmentation.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
- Validate zoning, masking, path policies and fabric independence; restore optimized healthy multipath.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
Explanation
Correct Answer
D:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Incorrect Answers
A:This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
B:This is the unsafe shortcut in the Malware persistence and containment scenario, not a justified remediation or diagnostic. Incident: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim.
C:That option would validate zoning, masking, path policies and fabric independence; restore optimized healthy multipath, but it addresses a different concern. Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Question 777
While reviewing the CompTIA Server+ administration incident, a technician learns: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim. Which principle most directly explains how to address the described issue safely? Select ONE best answer.
- Multipath configuration must be tested across real fabric failures and correct asymmetric access states.
- Evidence quality depends on provenance, timing and preservation, not only the volume of screenshots taken after recovery.
- Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
- Tagged VLAN traffic must be permitted end-to-end; routing changes do not repair a missing layer-two VLAN path.
Explanation
Correct Answer
C:Applying it leads to this operational action: Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
Incorrect Answers
A:This statement concerns SAN fabric multipath failover and latency, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
B:This statement concerns Log correlation and evidence preservation, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
D:This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair.
Question 778
Before a server change is approved, the on-call engineer receives this incident report: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
- Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
- Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
- Correlate system, application, hypervisor and switch events using aligned timestamps and event identifiers.
Explanation
Correct Answer
B:The expected technical relationship is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Incorrect Answers
A:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
C:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
D:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. This statement concerns Log correlation and evidence preservation, a different Server+ technical control.
Question 779
After the team implements a targeted remediation for Malware persistence and containment, the original incident was: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.
- A single-fabric outage causes no I/O loss and service returns to expected latency on supported paths.
- Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
- Protected cache operation is restored and write latency improves without compromising in-flight write safety.
- Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
Explanation
Correct Answer
B:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold.
Incorrect Answers
A:This statement concerns SAN fabric multipath failover and latency, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair.
C:This statement concerns Write cache battery and storage performance, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
D:This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Malware persistence and containment fault or prove its repair. For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. A targeted investigation checks: Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
Question 780
A change board is planning a verified response to this server event: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim. For the Malware persistence and containment issue, which response elements belong in the approved plan? Select TWO answers.
- Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.
- Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
- Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
- Collect time-synchronized logs, hardware alerts and relevant volatile evidence according to incident procedures before destructive action.
- Disable endpoint protection alerts while leaving unknown startup tasks running.
Explanation
Correct Answer
A:The expected technical relationship is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. Use findings to decide whether to: Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
C:Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. This is the appropriate targeted correction for Malware persistence and containment.
Incorrect Answers
B:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. It does not directly address the reported Malware persistence and containment fault or prove its repair.
D:For this incident, the relevant principle is: Malware response must address propagation and initial access; rebooting one host does not remove the attacker's foothold. The desired recovery condition is: Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
E:Incident: A compromised administrator workstation sends commands to multiple application servers but the operations team plans to reimage only one visible victim.
