cert
cert-1
cert-2

Pass CompTIA SK0-005 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
SK0-005 Exam - Verified By Experts
SK0-005 Premium Bundle
$29.98

SK0-005 Premium Bundle

$79.99
$109.97
  • Premium File 617 Questions & Answers. Last update: Nov 13, 2026
  • Training Course 139 Video Lectures
  • Study Guide 533 Pages
 
$109.97
$79.99
accept 21 downloads in last 7 days
block-screenshots
Purchase CompTIA SK0-005 Exam Training Products Individually
CompTIA SK0-005 Premium File
Premium File 617 Q&A
$76.99$69.99
CompTIA SK0-005 Video Training Course
Training Course 139 Lectures
$21.99 $19.99
CompTIA SK0-005 PDF Study Guide
Study Guide 533 Pages
$21.99 $19.99
CompTIA SK0-005 Practice Test 80

Question 790

A change board is planning a verified response to this server event: A machine-management agent cannot connect to its controller after a certificate expires, and engineers propose skipping validation globally. For the Expired certificate and trust failure triage issue, which response elements belong in the approved plan? Select TWO answers.

  1. Inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates.
  2. Trace application errors, dependencies, configuration and resource metrics; restore a supported version or correct the actual limit.
  3. Collect handshake diagnostics, SAN/issuer fields, trust store configuration and date/time status.
  4. Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
  5. Set every client to ignore certificate errors permanently to make the connection green.

Explanation

Correct Answer

A:

TLS trust failures are security-relevant authentication errors and require targeted trust repair, not blanket verification bypass. A successful outcome is: Authenticated TLS succeeds from all expected clients without disabling validation.

C:

The expected technical relationship is: TLS trust failures are security-relevant authentication errors and require targeted trust repair, not blanket verification bypass.

Incorrect Answers

B:

That option would trace application errors, dependencies, configuration and resource metrics; restore a supported version or correct the actual limit, but it addresses a different concern. TLS trust failures are security-relevant authentication errors and require targeted trust repair, not blanket verification bypass.

D:

This statement concerns Unauthorized outbound traffic and exfiltration detection, a different Server+ technical control. It does not directly address the reported Expired certificate and trust failure triage fault or prove its repair. For this incident, the relevant principle is: TLS trust failures are security-relevant authentication errors and require targeted trust repair, not blanket verification bypass.

E:

This is the unsafe shortcut in the Expired certificate and trust failure triage scenario, not a justified remediation or diagnostic. Discriminate using: Collect handshake diagnostics, SAN/issuer fields, trust store configuration and date/time status.

Question 791

A server administrator is investigating a server issue involving unauthorized outbound traffic and exfiltration detection: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Isolate affected hosts, preserve evidence and investigate persistence and lateral movement before controlled remediation.
  2. Restrict management exposure, enforce MFA and rate limiting and investigate authentication events and compromised credentials.
  3. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.
  4. Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.

Explanation

Correct Answer

D:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. For this case, A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress.

Incorrect Answers

A:

This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

B:

This statement concerns Brute-force authentication and account lockout, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

C:

This is the unsafe shortcut in the Unauthorized outbound traffic and exfiltration detection scenario, not a justified remediation or diagnostic. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

Question 792

While reviewing the CompTIA Server+ administration incident, a technician learns: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. Multipath configuration must be tested across real fabric failures and correct asymmetric access states.
  2. Tagged VLAN traffic must be permitted end-to-end; routing changes do not repair a missing layer-two VLAN path.
  3. TLS trust failures are security-relevant authentication errors and require targeted trust repair, not blanket verification bypass.
  4. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

Explanation

Correct Answer

D:

Collect evidence first: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Incorrect Answers

A:

This statement concerns SAN fabric multipath failover and latency, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

B:

This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

C:

This statement concerns Expired certificate and trust failure triage, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

Question 793

Before a server change is approved, the on-call engineer receives this incident report: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.
  2. Collect handshake diagnostics, SAN/issuer fields, trust store configuration and date/time status.
  3. Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.
  4. Review EDR process trees, scheduled tasks, outbound connections, privileged logins and related host indicators.

Explanation

Correct Answer

C:

These observations investigate the exact Unauthorized outbound traffic and exfiltration detection failure rather than unrelated components. Incident: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress.

Incorrect Answers

A:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. This is the unsafe shortcut in the Unauthorized outbound traffic and exfiltration detection scenario, not a justified remediation or diagnostic.

B:

For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

D:

For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Incident: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress.

Question 794

After the team implements a targeted remediation for Unauthorized outbound traffic and exfiltration detection, the original incident was: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
  2. Sustained stress tests run within component thermal limits without unexpected throttling or shutdown.
  3. Malicious login attempts are contained without losing authorized administrative access.
  4. Only intended VLANs traverse the trunk and test VMs reach their approved peers.

Explanation

Correct Answer

A:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Incident: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress.

Incorrect Answers

B:

This statement concerns Thermal shutdown and heatsink diagnostics, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

C:

This statement concerns Brute-force authentication and account lockout, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair.

D:

This statement concerns Incorrect switch VLAN trunk allowance, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair.

Question 795

A change board is planning a verified response to this server event: A backup server suddenly uploads gigabytes to a new external domain outside the change window, but the firewall allows all egress. For the Unauthorized outbound traffic and exfiltration detection issue, which response elements belong in the approved plan? Select ONE best answer.

  1. Compare dig/nslookup answers per resolver, cache state, DNS suffix, zone authority and TTLs.
  2. Inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates.
  3. Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths. Then validate the change by confirming: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
  4. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.

Explanation

Correct Answer

C:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Before modifying systems, gather: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Incorrect Answers

A:

That option would compare dig/nslookup answers per resolver, cache state, DNS suffix, zone authority and TTLs, but it addresses a different concern. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

B:

That option would inspect the certificate chain, names, validity and trusted roots, then renew or repair the appropriate certificates, but it addresses a different concern. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

D:

This is the unsafe shortcut in the Unauthorized outbound traffic and exfiltration detection scenario, not a justified remediation or diagnostic. Discriminate using: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Question 796

A server administrator is investigating a server issue involving unauthorized outbound traffic and exfiltration detection: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger. The change must address the documented fault without creating unrelated risk. Which corrective action is most appropriate? Select ONE best answer.

  1. Compare changed package and driver versions, confirm a supported regression and execute an approved rollback or fixed update.
  2. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.
  3. Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
  4. Test client resolvers and cached records, correct zone or resolver settings and honor TTL behavior.

Explanation

Correct Answer

C:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Before rollout, confirm the problem with: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Incorrect Answers

A:

That option would compare changed package and driver versions, confirm a supported regression and execute an approved rollback or fixed update, but it addresses a different concern. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

B:

This is the unsafe shortcut in the Unauthorized outbound traffic and exfiltration detection scenario, not a justified remediation or diagnostic. Incident: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger.

D:

This statement concerns DNS client-specific failure, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

Question 797

While reviewing the CompTIA Server+ administration incident, a technician learns: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger. Which principle most directly explains how to address the described issue safely? Select ONE best answer.

  1. A close timeline between change and failure is a hypothesis to test, not automatic proof of cause.
  2. Name resolution failures should be isolated from transport connectivity by comparing direct IP and DNS queries.
  3. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.
  4. Write-back caching requires reliable protected power or flash persistence; disabling cache can raise latency for safety.

Explanation

Correct Answer

C:

Collect evidence first: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. This is the controlling principle for the reported Unauthorized outbound traffic and exfiltration detection incident.

Incorrect Answers

A:

This statement concerns OS patch regression and rollback, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

B:

This statement concerns DNS client-specific failure, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair.

D:

This statement concerns Write cache battery and storage performance, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

Question 798

Before a server change is approved, the on-call engineer receives this incident report: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger. Which evidence would most directly establish the stated root-cause hypothesis? Select ONE best answer.

  1. Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.
  2. Examine controller cache mode, BBU/flash status, workload write latency and vendor alerts.
  3. Inspect source IP patterns, failed/successful sign-ins, privileged access rules and MFA challenges.
  4. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.

Explanation

Correct Answer

A:

These observations investigate the exact Unauthorized outbound traffic and exfiltration detection failure rather than unrelated components. The expected technical relationship is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

Incorrect Answers

B:

For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. This statement concerns Write cache battery and storage performance, a different Server+ technical control.

C:

For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. This statement concerns Brute-force authentication and account lockout, a different Server+ technical control.

D:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Discriminate using: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Question 799

After the team implements a targeted remediation for Unauthorized outbound traffic and exfiltration detection, the original incident was: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger. Which acceptance criterion would best demonstrate a durable and safe resolution? Select ONE best answer.

  1. Affected systems are contained, persistent mechanisms removed and monitored restoration shows no renewed indicators.
  2. Affected clients resolve the correct application endpoint and connect consistently.
  3. Clients obtain unique approved addresses and correct gateways without duplicate-IP warnings.
  4. Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

Explanation

Correct Answer

D:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Compare against pre-change evidence: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.

Incorrect Answers

A:

This statement concerns Malware persistence and containment, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

B:

This statement concerns DNS client-specific failure, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius.

C:

This statement concerns DHCP and IP address conflict isolation, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

Question 800

A change board is planning a verified response to this server event: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger. For the Unauthorized outbound traffic and exfiltration detection issue, which response elements belong in the approved plan? Select THREE answers.

  1. Compare changed package and driver versions, confirm a supported regression and execute an approved rollback or fixed update.
  2. Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.
  3. Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.
  4. Whitelist all outbound destinations to avoid interrupting any transfer during an exfiltration alert.
  5. Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins.
  6. Collect handshake diagnostics, SAN/issuer fields, trust store configuration and date/time status.

Explanation

Correct Answer

B:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. Incident: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger.

C:

Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. This is the appropriate targeted correction for Unauthorized outbound traffic and exfiltration detection.

E:

These observations investigate the exact Unauthorized outbound traffic and exfiltration detection failure rather than unrelated components. Incident: A database host begins making encrypted outbound sessions to unknown IPs after a suspicious admin login and DLP alerts trigger.

Incorrect Answers

A:

That option would compare changed package and driver versions, confirm a supported regression and execute an approved rollback or fixed update, but it addresses a different concern. Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. This statement concerns OS patch regression and rollback, a different Server+ technical control.

D:

Instead, the supported correction is: Contain unapproved egress, preserve flow and endpoint evidence and validate allowed destinations before reopening paths.

F:

This statement concerns Expired certificate and trust failure triage, a different Server+ technical control. It does not directly address the reported Unauthorized outbound traffic and exfiltration detection fault or prove its repair. For this incident, the relevant principle is: Unusual outbound volume and destinations may indicate exfiltration; investigation must preserve evidence and scope blast radius. A targeted investigation checks: Correlate firewall/NetFlow records, process ownership, DNS logs, DLP alerts and identity sign-ins. The desired recovery condition is: Unapproved outbound flows stop, legitimate data transfers remain and incident findings are documented.

CompTIA Server+ Certification Exam (SK0-005) Practice Tests