Free SK0-005 Practice Test Questions and Answers (2026)

Asecurity guardis a human element in physical security, making them susceptible tosocial

engineering attacks. Social engineering exploits human behavior, and a guard can be tricked into

allowing unauthorized access through persuasion, manipulation, or deception.

Security guard (Answer A):Human elements are the most vulnerable to social engineering techniques

like impersonation or manipulation.

Access control vestibule (Option B):This is a physical security barrier, which is harder to exploit

through social engineering.

Perimeter fencing (Option C):This is a static physical barrier, not susceptible to social engineering.

Biometric locks (Option D):These rely on biological data and are not susceptible to social engineering

in the same way a human would be.

Bollards (Option E):Physical barriers that are not vulnerable to social engineering.

CompTIA Server+ Reference:This topic relates toSK0-005 Objective 4.4: Implement physical security

controls.

The best policy to deter a brute-force login attack is account lockout threshold. A brute-force login

attack is a type of attack that tries to guess a user’s password by trying different combinations of

characters until it finds the correct one. This attack can be performed manually or with automated

tools that use dictionaries, wordlists, or algorithms. An account lockout threshold is a policy that

specifies how many failed login attempts are allowed before an account is locked out temporarily or

permanently. This policy prevents an attacker from trying unlimited password guesses and reduces

the chances of finding the correct password.

The administrator should use an IP KVM to access the server’s console remotely for bare-metal

maintenance. An IP KVM stands for Internet Protocol Keyboard Video Mouse, which is a device that

allows remote control of a server’s keyboard, video, and mouse over a network connection, such as

LAN or Internet. An IP KVM enables an administrator to perform tasks such as BIOS configuration,

boot sequence selection, operating system installation, etc., without being physically present at the

server location.

The other options are not suitable for bare-metal maintenance because they require either physical

access to the server (a crash cart) or an operating system running on the server (VNC, RDP, SSH). A

crash cart is a mobile unit that contains a monitor, keyboard, mouse, and cables that can be plugged

into a server for direct access to its console. VNC stands for Virtual Network Computing, which is a

software that allows remote desktop sharing and control over a network connection using a

graphical user interface (GUI). RDP stands for Remote Desktop Protocol, which is a protocol that

allows remote desktop access and control over a network connection using a GUI or command-line

interface (CLI). SSH stands for Secure Shell, which is a protocol that allows secure remote login and

command execution over a network connection using a CLI.

Insider threat is the most likely system vulnerability in a company that deploys antivirus, anti-

malware, and firewalls that can be assumed to be functioning properly. An insider threat is a

malicious or negligent act by an authorized user of a system or network that compromises the

security or integrity of the system or network. An insider threat can include data theft, sabotage,

espionage, fraud, or other types of attacks. Antivirus, anti-malware, and firewalls are security tools

that can protect a system or network from external threats, such as viruses, worms, ransomware, or

open ports. However, these tools cannot prevent an insider threat from exploiting their access

privileges or credentials to harm the system or network.

The administrator must encrypt the data at rest to ensure data on the SAN is not compromised if it is

leaked. Data at rest refers to data that is stored on a device or a medium, such as a hard drive, a flash

drive, or a SAN (Storage Area Network). Data at rest can be leaked if the device or the medium is lost,

stolen, or accessed byunauthorized parties. Encrypting data at rest means applying an algorithm that

transforms the data into an unreadable format that can only be decrypted with a key. Encryption

protects data at rest from being exposed or misused by attackers who may obtain the device or the

medium.

The technician should use port 22 to configure a server that requires secure remote access. Port 22 is

the default port for Secure Shell (SSH), which is a protocol that allows secure remote login and

command execution over a network connection using a command-line interface (CLI). SSH encrypts

both the authentication and data transmission between the client and the server, preventing

eavesdropping, tampering, or spoofing. SSH can be used to perform various tasks on a server

remotely, such as configuration, administration, maintenance, troubleshooting, etc.

Cloud software licensing refers to the process of managing and storing software licenses in the cloud.

The benefits of cloud software licensing models are vast. The main and most attractive benefit has to

do with the ease of use for software vendors and the ability to provide customizable cloud software

license management based on customer needs and desires1. Cloud-based licensing gives software

developers and vendors the opportunity to deliver software easily and quickly and gives customers

full control over their licenses, their analytics, and more1. Cloud based licensing gives software

sellers the ability to add subscription models to their roster of services1. Subscription models are one

of the most popular forms of licensing today1. Users sign up for a subscription (often based on

various options and levels of use, features, etc.) and receive theirlicenses instantly1.

Reference: 1 Everything You Need to Know about Cloud Licensing | Thales

The administrator should close ports 21 and 23 to secure the server properly. Port 21 is used for FTP

(File Transfer Protocol), which is an unsecure protocol that allows file transfer between a client and a

server over a network connection. FTP does not encrypt the data or the credentials that are

transmitted, making them vulnerable to interception or modification by attackers. Port 23 is used for

Telnet, which is an unsecure protocol that allows remote login and command execution over a

network connection using a CLI. Telnet does not encrypt the data or the credentials that are

transmitted, making them vulnerable to interception or modification by attackers.

Reference:

https://www.csoonline.com/article/3191531/securing-risky-network-ports.html

The best way to protect an organization against social engineering is to provide recurring training and

support. Social engineering is a type of attack that exploits human psychology and behavior to

manipulate people into divulging confidential information or performing malicious actions. Social

engineering can take various forms, such as phishing emails, phone calls, impersonation, baiting, or

quid pro quo. The best defense against social engineering is to educate and empower the employees

to recognize and avoid common social engineering techniques and report any suspicious activities or

incidents. Recurring training and support can help raise awareness and reinforce best practices

among the employees.

The server is not joined to the domain is causing the issue. A domain is a logical grouping of

computers that share a common directory database and security policy on a network. Active

Directory is a Microsoft technology that provides domain services for Windows-based computers. To

use Active Directory credentials to log on to a server, the server must be joined to the domain that

hosts Active Directory. If the server is not joined to the domain, it will not be able to authenticate

with Active Directory and will only accept local accounts for logon. To join a server to a domain, the

administrator must have a valid domain account with sufficient privileges and must know the name

of the domain controller that hosts Active Directory.

The server administrator should use cable management to prevent network connectivity loss when

pulling a server from the rack during maintenance. Cablemanagement is a practice of organizing and

securing the cables that connect various devices and components in a system. Cable management

can help improve airflow, reduce clutter, prevent tangling, and avoid accidental disconnection or

damage of cables. Cable management can be done using various tools and techniques, such as cable

ties, cable trays, cable labels, cable organizers, or cable ducts.

A port scanner is the tool that would most likely help the analyst determine if the applications are

running on a remote server. A port scanner is a software tool that scans a network device for open

ports. Ports are logical endpoints for network communication that are associated with specific

applications or services. By scanning the ports on a remote server, the analyst can identify what

applications or services are running on that server and what protocols they are using. A port scanner

can also help detect potential vulnerabilities or misconfigurations on a server.

.

Explanation:

FinanceApp software is running as a service named “FinanceApp Service”. The service description

says “Provides financial data and calculations for the FinanceApp software”. The service status is

“Stopped”, which means that the service is not running and the software is not functional. The

service startup type is “Manual”, which means that the service needs to be started manually by the

user or the administrator. The service log on as is “Local System”, which means that the service runs

under a predefined local account that has extensive privileges on the local computer.

To fix the issue with the FinanceApp software, you need to do two things:

First, you need to start the service, so that the software can run. To do this, you can right-click on the

service name and select “Start” from the menu. Alternatively, you can select the service name and

click on the “Start” button on the toolbar. You should see a message saying that the service has

started successfully.

Second, you need to change the service startup type, so that the service can start automatically every

time the server boots up. This way,you don’t have to contact the help desk every time the issue

occurs. To do this, you can right-click on the service name and select “Properties” from the menu.

Alternatively, you can select the service name and click on the “Properties” button on the toolbar.

You should see a window with several tabs and options. On the “General” tab, under “Startup type”,

you can select “Automatic” from the drop-down list. Then, click on “OK” to save your changes.

By doing these two steps, you should be able to use the FinanceApp software without any problems.

The MarketApp software is running as a service named “MarketApp Service”. The service description

says “Provides market data and analysis for the MarketApp software”. The service status is

“Running”, which means that the service is running and the software is functional. However, as you

reported, the software may crash sometimes, which can cause significant downtime. The service

startup type is “Automatic”, which means that the service starts automatically every time the server

boots up. The service log on as is “TestAccount”, which is a test account that was probably used for

development or testing purposes.

To fix the issue with the MarketApp software, you need to do one thing:

You need to change the service log on as, so that the service runs under a proper account that has

sufficient permissions and security settings for production use. To do this, you can right-click on the

service name and select “Properties” from the menu. Alternatively, you can select the service name

and click on the “Properties” button on the toolbar. You should see a window with several tabs and

options. On the “Log On” tab, under “Log on as”, you can select either “Local System account” or

“This account”. If you choose “Local System account”, then the service will run under a predefined

local account that has extensive privileges on the local computer. If you choose “This account”, then

you will need to enter a valid username and password for an account that has appropriate

permissions and security settings for running the service. You may need to consult with your IT team

or your software vendor to determine which option is best for your situation. Then, click on “OK” to

save your changes.

The subnet mask is most likely containing an error that prevents the application server from

communicating with the newly installed database server. The subnet mask is a binary number that

defines how many bits of an IP address are used for the network portion and how many bits are used

for the host portion. The subnet mask determines which devices belong to the same network or

subnet and can communicate directly with each other without routing or switching devices. The

subnet mask of the database server is 255.255.O.O, which means that all 32 bits of its IP address are

used for the network portion and none for the host portion, which is invalid and makes it

unreachable by any other device on any network or subnet. The subnet mask of the application

server is 255.O.O.O, which means that only 8 bits of its IP address are used for the network portion

and 24 bits are used for the host portion, which is also uncommon and makes it incompatible with

most networks or subnets. Reference: [CompTIA Server+ Certification Exam Objectives], Domain 4.0:

Networking, Objective 4.1: Given a scenario, configure network settings for servers.

If users cannot access a new server by name, but the server does respond to a ping request using its

IP address, it means that there is a problem withname resolution. The DNS (Domain Name System) is

a service that maps hostnames to IP addresses and vice versa. Therefore, the best step to perform

next is to examine the DNS to see if the new server record exists and matches its IP address. If not,

the DNS record needs to be added or updated accordingly. Running the tracert command from a

workstation would not help with name resolution, as it only shows the route taken by packets to

reach a destination by IP address. Correcting the missing DHCP scope would not help either, as DHCP

(Dynamic Host Configuration Protocol) only assigns IP addresses and other network settings to

clients, but does not resolve names. Updating the workstation hosts file would be a temporary

workaround, but not a permanent solution, as it would require manually editing every workstation’s

hosts file with the new server’s name and IP address. Reference:

https://www.howtogeek.com/164981/how-to-use-nslookup-to-check-domain-name-information-inmicrosoft-windows/https://www.howtogeek.com/howto/27350/beginner-geek-how-to-edit-your-

hosts-file/

QSFP+ is a type of connector that should be used to connect a server to a switch that uses 40G

network connectivity. QSFP+ (Quad Small Form-factor Pluggable Plus) is a compact, hot-pluggable

transceiver module that supports data rates up to 40 Gbps. QSFP+ modules can be used for various

network protocols and media types, such as Ethernet, Fibre Channel, InfiniBand, or optical fiber.

QSFP+ modules have a 38-pin edge connector and can be inserted into a QSFP+ port on a switch or a

server. SFP+ (Small Form-factor Pluggable Plus) is a type of connector that supports data rates up to

10 Gbps, but not 40 Gbps. SFP+ modules have a 20-pin edge connector and can be inserted into an

SFP+ port on a switch or a server. GBIC (Gigabit Interface Converter) is an older type of connector

that supports data rates up to 1 Gbps, but not 40 Gbps. GBIC modules have an SC duplex connector

and can be inserted into a GBIC port on a switch or a server. SFP (Small Form-factor Pluggable) is

another older type of connector that supports data rates up to 1 Gbps or 4 Gbps, but not 40 Gbps.

SFP modules have an LC duplex connector and can be inserted into an SFP port on a switch or a

server. Reference: https://www.howtogeek.com/190014/virtualization-basics-understandingtechniques-and-fundamentals/ https://www.howtogeek.com/428483/what-is-end-to-end-

encryption-and-why-does-it-matter/ https://www.howtogeek.com/443611/how-to-encrypt-yourmacs-system-drive-removable-devices-and-individual-files/

The steps in the troubleshooting theory that should be performed after a solution has been

implemented are document the findings and notify the users. The troubleshooting theory is a

systematic process of identifying and resolving problems or issues with a system or device. The

troubleshooting theory consists of several steps that can be summarized as follows:

Identify the problem: Gather information, scope the issue, establish a theory of probable cause.

Establish a plan of action: Test the theory, determine next steps, escalate if necessary.

Implement the solution: Execute the plan, verify functionality, prevent recurrence.

Document the findings: Record actions taken, outcomes achieved, lessons learned.

Notify the users: Communicate resolution status, confirm satisfaction, provide follow-up.

Documenting the findings is an important step that helps create a record of what was done and why,

what worked and what didn’t, and what can be improved or avoided in the future. Documenting the

findings can also help with reporting, auditing, compliance, or training purposes. Notifying the users

is another important step that helps inform the affected parties of what was done and how it was

resolved, confirm that the problem is fixed and that they are satisfied with the outcome, and provide

any follow-up instructions or recommendations.