6.3. Practice Questions with Rationales

The following questions span all four domains and reflect the scenario-based format of the SK0-005 exam.

Question 1 A server with RAID 5 across five 4TB drives reports one drive has failed. A replacement drive is installed and the rebuild begins. Four hours into the rebuild, a second drive fails. What is the result?

A) The array completes the rebuild using the remaining drives B) All data on the array is lost C) The array switches to RAID 6 mode automatically D) The rebuild pauses until the second failed drive is replaced

Answer: B — RAID 5 can only survive one drive failure at a time. During a rebuild, the array is in a degraded state with no parity protection. A second drive failure during rebuild causes total data loss. RAID 6 would be required to tolerate two simultaneous failures.

Question 2 A technician is troubleshooting a server that cannot be reached by hostname but can be reached by IP address. Which tool should be used FIRST?

A) ping B) nslookup C) tracert D) netstat

Answer: B — The symptom (reachable by IP, not hostname) specifically indicates a name resolution problem. nslookup tests DNS directly. ping and tracert test Layer 3 connectivity (already known working). netstat shows connections.

Question 3 An administrator needs to deploy 75 identical Windows Server instances for a new cloud application. Each server must have unique SIDs and computer names, and the deployment should complete with minimal manual intervention. Which method is BEST?

A) Clone an existing server for each deployment B) Deploy from a sysprepped template with bootstrap scripts C) Manually install each server using GUI installation D) Use P2V conversion of an existing physical server

Answer: B — Template deployment from a sysprepped image gives each server a unique machine identity (computer name, machine account, activation, and SID) at first boot. Bootstrap scripts automate post-deployment configuration. Cloning without sysprep leaves duplicate machine identities and causes domain-join/GPO conflicts (A). Manual installation doesn't scale (C). P2V creates one VM from one physical server (D).

Question 4 After a maintenance window that included patching, users in a branch office report they cannot authenticate to the domain. Users in the main office authenticate normally. The branch office server can ping the domain controller by IP address. What is the MOST likely cause?

A) The domain controller's DNS service failed B) The branch office server's NTP synchronization is out of sync causing clock skew C) The branch office server's firewall is blocking port 389 D) Active Directory replication has failed between sites

Answer: B — The symptom (authentication fails in one location, not another; can reach DC by IP) combined with the recent patch window (patches sometimes affect NTP configuration) points to clock skew. Kerberos authentication fails when clocks differ by more than 5 minutes. A DNS service failure on the domain controller (A) would break name resolution for the main office too, yet main-office users authenticate normally—and note that a successful ping by IP says nothing about DNS health either way. Firewall (C) is possible but patching rarely changes firewall rules for LDAP. AD replication (D) would affect domain-wide issues differently.

Question 5 A data center uses hot aisle/cold aisle containment. An administrator notices that servers at the top of several racks are running significantly hotter than servers at the bottom. What is the MOST likely cause?

A) The servers at the top are more powerful and generate more heat B) Hot exhaust air from lower servers is recirculating to the top of the rack C) The PDU at the top of the rack is generating excessive heat D) The cooling system is set to a temperature that is too low

Answer: B — Hot exhaust from servers rises. In a poorly managed hot aisle or when containment is imperfect, hot air recirculates from the back (hot aisle side) around the top of the rack back to the front (cold aisle side). Servers at the top are the first to receive this recirculated hot air. The solution is better containment, blanking panels, or adjusting rack layout.

Question 6 Which backup method provides the FASTEST restore time but requires the MOST storage space and longest backup window?

A) Incremental B) Differential C) Full D) Synthetic full

Answer: C — A full backup captures everything every time. Restore requires only the single full backup set (fastest restore). It consumes the most storage and takes the longest to run. Incremental is fastest to back up but slowest to restore (requires full + all incrementals). Differential is a middle ground.

Question 7 An organization's SAN uses Fibre Channel for connectivity. After a storage array is replaced, the servers can no longer see the SAN LUNs. The FC cables and SFPs are confirmed good. What should be checked NEXT?

A) The servers' IP address configuration B) The WWPN zoning configuration on the FC fabric C) The RAID configuration on the new storage array D) The iSCSI initiator settings on each server

Answer: B — Fibre Channel uses zoning (configured on FC switches) to control which initiators (servers via HBA WWPNs) can see which targets (storage ports). When a storage array is replaced, its new WWPNs may not be zoned correctly with the server HBAs. iSCSI (D) is irrelevant — the scenario specifies Fibre Channel. IP configuration (A) is not used by FC.

Question 8 A server that was recently upgraded to a new OS version intermittently loses its correct date and time after reboots, reverting to a date from several years ago. What is the MOST likely hardware cause?

A) The NTP server is misconfigured B) The CMOS battery is failing C) The system clock driver is incompatible with the new OS D) The hypervisor is not synchronizing the guest clock

Answer: B — The CMOS battery maintains the hardware real-time clock when the system is powered off. A failing battery cannot hold a charge, so the date resets to a default (often the BIOS manufacturing date) after each power cycle. NTP (A) would apply after boot, not cause a reset to a historical date. Driver incompatibility (C) and hypervisor sync (D) are possible but less likely than a failing CMOS battery in this specific symptom pattern.

Question 9 An administrator implements two-factor authentication for VPN access using a username/password plus a security question. A security auditor flags this as insufficient MFA. Why?

A) VPN does not support MFA B) Both factors are in the same category (something you know) C) Security questions are not considered a valid factor D) MFA requires at least three factors

Answer: B — True MFA requires factors from at least two different categories. A password and a security question are both "something you know" — this is still single-factor authentication despite involving two steps. Valid second factors would be a hardware token, smart card, authenticator app (something you have), or biometric (something you are).

Question 10 During a troubleshooting session, a technician makes three configuration changes simultaneously to resolve an issue. After the changes, the problem appears resolved. What is the PRIMARY risk of this approach?

A) The server may require a restart before changes take effect B) The technician cannot identify which change resolved the problem C) All three changes must be documented separately D) The changes may violate the change management policy

Answer: B — Making multiple simultaneous changes violates the "one change at a time" principle of Step 5 in the troubleshooting methodology. When the problem resolves, you cannot determine which change fixed it — or whether one of the other changes introduced a new problem. Documentation (C) and change management (D) are secondary concerns; the core violation is diagnostic methodology.