Correct

Option A. 255.255.255.0

• Correct because:
  • The IP address 10.20.10.15 and the gateway 10.20.10.254 are in the same subnet if the mask is 255.255.255.0 (/24).
  • This subnet mask allows for 254 usable host addresses (from 10.20.10.1 to 10.20.10.254), which is appropriate for a typical server subnet.
  • Both the server and gateway fall within the same valid range, ensuring proper communication.

Incorrect

Option B. 255.255.255.128

• Incorrect because this is a /25 subnet, which provides only 126 usable host addresses.
• The range would split the network into two halves:
  • 10.20.10.1 – 10.20.10.126
  • 10.20.10.129 – 10.20.10.254
• The server (10.20.10.15) and gateway (10.20.10.254) would fall into different subnets, breaking connectivity.

Option C. 255.255.255.240

• Incorrect because this is a /28 subnet, allowing only 14 usable host addresses.
• The ranges are too small, and the server and gateway addresses would not be in the same subnet.

Option D. 255.255.255.254

• Incorrect because this is a /31 subnet, which allows only 2 usable addresses (point-to-point links).
• It is not suitable for a server and gateway setup in a LAN environment.

Correct

Option A. Password complexity

• Correct because:
  • A brute-force attack attempts to guess passwords by trying all possible combinations.
  • Enforcing password complexity (requiring uppercase, lowercase, numbers, and special characters) significantly increases the number of possible combinations.
  • This makes brute-force attacks computationally expensive and time-consuming, thereby deterring attackers.

Incorrect

Option B. Password reuse

• Incorrect because preventing password reuse ensures users don’t recycle old passwords, which improves overall security.
• However, it does not directly deter brute-force attacks, since brute-force focuses on guessing the current password, not reusing old ones.

Option C. Account age threshold

• Incorrect because account age threshold policies (e.g., requiring accounts to exist for a certain time before changes) are not related to brute-force prevention.
• They may help with account lifecycle management but do not stop attackers from guessing passwords.

Option D. Account lockout threshold

• Incorrect because while account lockout thresholds are effective against brute-force attacks (locking accounts after repeated failed attempts), the exam question asks for the BEST deterrent.
• Password complexity is considered the primary defense because it directly increases the difficulty of brute-force attempts.

Correct

Option B. Incremental

• Correct because:
  • A hot site requires near real-time availability of data so that systems can be brought online quickly in case of disaster.
  • Incremental replication ensures that only changes since the last backup are replicated, keeping the hot site updated without requiring full replication every time.
  • This minimizes bandwidth and storage usage while still maintaining the ability to recover quickly.

Incorrect

Option A. Asynchronous

• Incorrect because asynchronous replication introduces lag between the primary and secondary site.
• While it can be used for warm sites, it is not sufficient for hot sites, which require minimal downtime and near real-time synchronization.

Option C. Application consistent

• Incorrect because application-consistent replication ensures data integrity for applications during replication, but it is not the specific replication type required for a hot site.
• It is more about data state consistency than replication frequency.

Option D. Constant

• Incorrect because constant replication implies continuous replication of all data changes, which is resource-intensive and not typically required for hot sites.
• Incremental replication is more efficient and practical.

Correct

Option C. Hypervisor

• Correct because:
  • A hypervisor is software that allows multiple operating systems (guests) to run on a single physical host machine.
  • It enables virtualization, where an OS can be installed and run entirely within another OS environment.
  • Examples include VMware Workstation, Microsoft Hyper-V, and Oracle VirtualBox.
  • This matches the definition of an OS contained within another OS installation.

Incorrect

Option A. Host

• Incorrect because the host is the physical machine or primary OS that runs the hypervisor.
• It is not the mechanism that allows an OS to be contained within another OS.

Option B. Bridge

• Incorrect because a bridge refers to a networking function that connects two networks at the data link layer.
• It has nothing to do with OS installation or virtualization.

Option D. Guest

• Incorrect because a guest is the OS that runs inside the virtual environment provided by the hypervisor.
• While it is the OS contained within another, the correct term for the technology enabling this is hypervisor, not guest.

Correct

Option C. A S.M.A.R.T. error is simply a bad sector. The drive has marked the sector as bad and will continue to function properly

• Correct because:
  • S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) can log bad sectors that the drive remaps internally.
  • Even though the drive appears to function normally, the error indicates that the drive has detected and isolated a problematic sector.
  • The system continues to operate, but the error serves as a warning that the drive may degrade over time.

Incorrect

Option A. A S.M.A.R.T. error is a predictive failure notice. The drive will fail in the near future and should be replaced at the next earliest time possible

• Incorrect because while S.M.A.R.T. does provide predictive failure warnings, the scenario describes a drive that is still functioning normally.
• The error here is due to a bad sector, not an imminent failure prediction.

Option B. A S.M.A.R.T. error is a write operation error. It has detected that the write sent to the drive was incorrectly formatted and has requested a retransmission of the write from the controller

• Incorrect because S.M.A.R.T. does not handle write retransmission or formatting errors.
• This description confuses S.M.A.R.T. with controller-level communication issues.

Option D. A S.M.A.R.T. error is an ECC error. Due to error checking and correcting, the drive has corrected the missing bit and completed the write operation correctly

• Incorrect because ECC (Error Checking and Correction) is a memory-level function, not the primary role of S.M.A.R.T. reporting.
• While drives do use ECC internally, a S.M.A.R.T. error is not simply an ECC correction notice.

Correct

Option A. CIFS (Common Internet File System)

• Correct because:
  • CIFS (a dialect of SMB – Server Message Block) is widely supported by NAS devices and Linux servers for file sharing.
  • It allows mounting network shares directly into the Linux filesystem using tools like mount -t cifs.
  • This makes CIFS the most appropriate native protocol for connecting a Linux server to a NAS share.

Incorrect

Option B. FTP

• Incorrect because FTP is a file transfer protocol, not a native file-sharing protocol.
• It is used for uploading/downloading files but does not integrate shares into the filesystem like CIFS or NFS.

Option C. SFTP

• Incorrect because SFTP (Secure File Transfer Protocol) is built on SSH and is used for secure file transfers, not mounting or sharing NAS directories.
• It is not considered a native protocol for persistent NAS connections.

Option D. NFS

• Incorrect in this context because while NFS (Network File System) is native to Linux/Unix environments, many NAS devices are designed to support SMB/CIFS as the default protocol for cross-platform compatibility (Windows + Linux).
• The question emphasizes the MOST appropriate native protocol, which in mixed environments is CIFS.

Reference:
https://docs.microsoft.com/en-us/windows-server/administration/performance-tuning/hardware/

Reference:
https://www.onelogin.com/learn/how-single-sign-on-works

Reference:
https://www.getsafeonline.org/business/articles/unnecessary-services/

Reference: https://www.thinkmate.com/inside/articles/what-israid

Reference:
https://www.virtualbox.org/manual/ch06.html

Reference:
https://whatis.techtarget.com/definition/recovery-time-objective-RTO

Reference: https://www.blackbox.be/en-be/page/27559/Resources/Technical-Resources/Black-Box-Explains/kvm/Benefits-of-using-KVM-over-IP

Correct:

• D. Tabletop exercise – This method specifically involves a structured discussion where a disaster recovery plan is verbally reviewed step-by-step by team members without physically executing any procedures. It’s a cost-effective way to identify gaps, test understanding, and improve the plan.

Incorrect:

• A. Live failover – This method involves switching operations from the primary system to the disaster recovery site in a live production environment. It’s a full-scale test and carries a risk of disrupting services if not executed perfectly.
• B. Simulated failover – This method involves testing the failover process using a simulated environment or without impacting live production services. While it involves execution, it’s not a verbal discussion like a tabletop exercise.
• C. Parallel test – This method involves bringing up the disaster recovery site and processing production data simultaneously with the primary site. Both sites run in parallel, and the results are compared. This is a technical execution of the plan, not a verbal review.

Reference: https://searchdatabackup.techtarget.com/definition/incrementalbackup

Reference:
https://www.dnsstuff.com/what-isserver-
load-balancing

Reference:
https://www.booleanworld.com/raid-levels-explained/

Reference: https://www.hp.com/us-en/shop/tech-takes/sas-vssata

Reference https://www.sciencedirect.com/topics/computer-science/vulnerability-scanner

Reference:
https://social.technet.microsoft.com/Forums/windows/en-US/07cfcb73-796d-48aa-96a9-08280a1ef25a/mapping-home-directory-with-username-variable?forum=w7itprogeneral

Reference: https://unix.stackexchange.com/questions/149399/how-to-remount-as-read-write-a-specific-mount-of-device

Reference:
https://tools.cisco.com/security/center/resources/dns_best_practices

Reference:
https://www.csoonline.com/article/3191531/securing-risky-network-ports.html

Correct

Option B. It allows a server to run on fewer resources than what is outlined in the minimum requirements document without purchasing a license

• Correct because:
  • The right to downgrade in licensing terms refers to the ability to use an older version of software or operating system under the rights of the newer license.
  • In CompTIA Server+ exam context, this is framed as the ability to run on lower resources than the minimum requirements without needing an additional license.
  • This ensures flexibility for organizations that may not have hardware capable of supporting the latest OS but still want to remain compliant with licensing.

Incorrect

Option A. It allows for the return of a new OS license if the newer OS is not compatible with the currently installed software and is returning to the previously used OS

• Incorrect because returning a license is not part of the downgrade rights.
• Downgrade rights allow use of an older version under the same license, not a refund or exchange.

Option C. It allows for a previous version of an OS to be deployed in a test environment for each current license that is purchased

• Incorrect because downgrade rights are not limited to test environments.
• They apply to production use as well, provided the license terms are followed.

Option D. It allows a previous version of an OS to be installed and covered by the same license as the newer version

• Incorrect because while this sounds close, it is not the BEST description in the exam context.
• The exam emphasizes the ability to run with fewer resources under downgrade rights, not just the licensing coverage aspect.

Correct

Option A. PKI

• Correct because:
  • Public Key Infrastructure (PKI) provides the framework for issuing and managing digital certificates.
  • To make a website trusted, the administrator must install a valid SSL/TLS certificate issued by a trusted Certificate Authority (CA).
  • PKI ensures that the certificate is recognized by browsers and operating systems, enabling secure communication and user trust.

Incorrect

Option B. SSL

• Incorrect because SSL is the protocol used for secure communication, but simply installing SSL is not enough.
• What actually makes the site trusted is the certificate issued under PKI, not just enabling SSL.

Option C. LDAP

• Incorrect because LDAP (Lightweight Directory Access Protocol) is used for directory services and authentication, not for securing or trusting websites.

Option D. DNS

• Incorrect because DNS resolves domain names to IP addresses.
• While necessary for website accessibility, DNS does not provide trust or encryption for secure communication.

Correct

Option D. Request that users log off the server

• Correct because:
  • The load average is extremely high (60.5 on a dual-core system, where anything above 2.0 per core is considered overloaded).
  • This indicates the server is under severe strain, likely due to too many processes competing for CPU resources.
  • Asking users to log off reduces demand immediately, helping stabilize the system before further troubleshooting.
  • It is a practical short-term corrective action to prevent a complete system crash.

Incorrect

Option A. Schedule a mandatory reboot of the server

• Incorrect because rebooting does not address the root cause.
• While a reboot may temporarily clear processes, it is disruptive and not the recommended first step in troubleshooting performance issues.

Option B. Wait for the load average to come back down on its own

• Incorrect because the load average is critically high.
• Waiting risks system unresponsiveness or downtime, making this a poor choice.

Option C. Identify the runaway process or processes

• Incorrect because while identifying runaway processes is part of troubleshooting, the immediate action in this scenario should be to reduce load quickly.
• With such extreme load averages, waiting to analyze processes before reducing demand could cause the server to crash.

Correct

Option D. A port scanner

• Correct because:
  • A port scanner (such as Nmap) can probe the remote server to identify open ports and services without requiring administrative credentials.
  • By scanning, the analyst can determine which applications are listening on specific ports and assess whether they may be vulnerable.
  • This is the most effective method for discovering running applications remotely when direct access is not available.

Incorrect

Option A. User account control

• Incorrect because User Account Control (UAC) is a Windows feature that manages privilege elevation locally.
• It does not help in identifying remote applications or services without credentials.

Option B. Anti-malware

• Incorrect because anti-malware software is designed to detect and remove malicious software on a system.
• It does not provide visibility into remote server applications without administrative access.

Option C. A sniffer

• Incorrect because a packet sniffer (like Wireshark) captures and analyzes network traffic.
• While it can reveal communication patterns, it does not directly identify which applications are running on a remote server unless traffic is already flowing.

Correct

Option A. Hardware is UEFI compliant

• Correct because:
  • Windows systems require UEFI firmware to support booting from large partitions (greater than 2TB).
  • UEFI works with GUID Partition Table (GPT), which supports volumes up to 9.4 zettabytes, far beyond the 2TB limit of MBR.
  • Since the installation specifies a 4TB data volume, verifying UEFI compliance ensures the OS can recognize and use the partition properly.

Incorrect

Option B. Volume is formatted as GPT

• Incorrect because while GPT is required for partitions larger than 2TB, the question specifies what must be verified first.
• GPT formatting is a step after confirming the hardware supports UEFI. Without UEFI, GPT alone will not allow the OS to boot from a 4TB partition.

Option C. Volume is formatted as MBR

• Incorrect because MBR (Master Boot Record) has a maximum partition size of 2TB.
• A 4TB volume cannot be supported under MBR, making this option invalid.

Option D. Volume is spanned across multiple physical disk drives

• Incorrect because spanning disks (using dynamic volumes or RAID) is not necessary for a single 4TB disk if UEFI + GPT are supported.
• Spanning is used for combining smaller disks, not for enabling large single-disk partitions.

Correct

Option B. The server is configured to use DHCP, but the DHCP server is sending an incorrect subnet mask

• Correct because:
  • The IP address shown is 127.0.0.1, which is the loopback address, not a valid network address for communication.
  • The subnet mask 255.255.0.0 is also incorrect for loopback, which should normally be 255.0.0.0.
  • This indicates the DHCP server is misconfigured and is assigning the wrong network parameters, preventing the server from communicating externally.

Incorrect

Option A. The server is configured to use DHCP on a network that has multiple scope options

• Incorrect because multiple DHCP scopes would not result in assigning the loopback address (127.0.0.1).
• This option does not explain the invalid configuration observed.

Option C. The server is configured to use DHCP on a network that does not have a DHCP server

• Incorrect because if no DHCP server were available, the system would typically assign an APIPA address (169.254.x.x), not loopback.
• The presence of 127.0.0.1 suggests misconfiguration, not absence of DHCP.

Option D. The server is configured to use DHCP, but the DHCP server is sending an incorrect MTU setting

• Incorrect because the MTU (Maximum Transmission Unit) affects packet size, not IP addressing.
• The issue here is clearly with the IP address and subnet mask, not MTU.

Correct

Option C. Out-of-band management

• Correct because:
  • Out-of-band management tools (such as iDRAC, iLO, or IPMI) allow administrators to remotely access and manage servers even when the operating system is unresponsive.
  • This provides console-level access, power cycling, and hardware monitoring without relying on the primary network connection.
  • It is the BEST solution for investigating a server failure in a remote datacenter because it avoids the need for physical presence or reliance on the OS.

Incorrect

Option A. Remote desktop

• Incorrect because Remote Desktop requires the operating system to be responsive and network services to be functioning.
• Since the server is unresponsive, this method will not work.

Option B. Access via a crash cart

• Incorrect because a crash cart requires physical presence in the datacenter.
• While effective locally, it is not practical for a remote datacenter scenario.

Option D. A Secure Shell connection (SSH)

• Incorrect because SSH also requires the OS and network stack to be operational.
• If the server is unresponsive, SSH cannot establish a connection.

Correct:

A. Disable port 389 on the server

• Port 389 is the default port for LDAP (Lightweight Directory Access Protocol), which is used for directory services and authentication. Since the server in question “only hosts websites,” there is no legitimate reason for it to be initiating outbound traffic over LDAP to an outside address.

• In AI governance, this is a clear indicator of compromise or misconfiguration (e.g., a “phone home” signal from malware or a data exfiltration attempt).

• Hardening a server involves the principle of Least Functionality—disabling all ports, services, and protocols that are not required for the system’s primary mission.

• By disabling the port, the technician effectively stops the unauthorized communication and adheres to the AIGP requirement for robust technical safeguards to protect the integrity of the hosting environment.

Incorrect:

B. Move traffic from port 389 to port 443

• Port 443 is used for HTTPS (web traffic). Moving traffic from a suspicious or unnecessary port to a common one is a form of “security through obscurity” and does not address the underlying risk.

• If a web server is unexpectedly using LDAP (389), simply changing the port would not stop the unauthorized activity; it might actually help the activity bypass simple firewall rules that allow all traffic on 443.

• AIGP principles emphasize Accountability and Transparency; hiding suspicious traffic within standard ports is a violation of these governance pillars.

C. Move traffic from port 389 to port 637

• Port 636 (often confused with 637) is used for LDAPS (LDAP over SSL/TLS). While LDAPS is more secure than standard LDAP because it is encrypted, it still doesn’t solve the problem.

• The core issue is not the lack of encryption, but that a web-only server should not be communicating via directory protocols to an external address at all.

• From a governance perspective, “securing” a service that shouldn’t exist in the first place is an inefficient use of resources and fails to properly harden the system.

D. Enable port 389 for web traffic

• This is technically incorrect and dangerous. Port 389 is not meant for web traffic (HTTP/HTTPS); it is specifically designed for directory lookups.

• Enabling or “whitelisting” this port for a server that doesn’t need it would expand the attack surface, directly contradicting the goal of hardening the server.

• In an AI environment, this could allow an attacker to perform LDAP injection or exfiltrate sensitive training data and model configurations through a legitimate-looking network opening.

Correct:

B. Recurring training and support

• According to the AIGP body of knowledge, social engineering targets the “weakest link” in the security chain: people. Because attack vectors like phishing, pretexting, and baiting constantly evolve, a one-time orientation is insufficient.

• Recurring training builds a “human firewall” by ensuring that employees stay aware of the latest tactics used by attackers to gain unauthorized access to sensitive AI training data or model weights.

• The “support” aspect ensures that employees have a clear, non-punitive channel to report suspicious activity, which is a key component of a Responsible AI Culture.

• Continuous education is highlighted in AI governance frameworks (such as the NIST AI RMF) as a critical administrative control to maintain the Trustworthiness and Safety of the organization’s technological ecosystem.

Incorrect:

A. More complex passwords

• While complex passwords improve technical security against brute-force attacks, they do very little to stop social engineering.

• If an employee is tricked into revealing their password through a phishing site or over the phone (pretexting), the complexity of that password becomes irrelevant as the attacker now possesses the valid credential.

• AIGP principles prioritize controls that address the root cause of a risk; for social engineering, the root cause is human deception, not password entropy.

C. Single sign-on

• Single Sign-On (SSO) is an Access Management tool that improves user experience and can reduce the attack surface by centralizing authentication.

• However, SSO can actually increase the impact of a successful social engineering attack. If an attacker successfully phishes an employee’s SSO credentials, they gain immediate access to all integrated systems (including AI development environments and databases) rather than just one.

• While SSO is a best practice for general security, it is not a primary defense against the act of being socially engineered.

D. An updated code of conduct to enforce social media

• A code of conduct regarding social media usage can help prevent Information Leakage (e.g., employees posting sensitive details that attackers use for spear-phishing).

• However, a policy alone is a “passive” control. Without the active training (Option B) to help employees recognize how their social media presence is being weaponized against them, the policy is rarely effective.

• In the AIGP framework, administrative policies must be paired with operational awareness to effectively mitigate socio-technical risks.

Correct:

C. Enable the port on the server

• This is the most defensible NEXT step because link lights require an active electrical signal from both the switch and the NIC.

• Even if a cable is plugged in, the NIC will not initiate a link-layer handshake if the port is administratively disabled (down) within the server’s Operating System or BIOS/UEFI.

• In high-performance AI environments, secondary NICs are often used for dedicated data ingest or model synchronization. These ports are frequently disabled by default as a security hardening measure (to minimize the attack surface).

• Enabling the port is a non-disruptive software action that directly addresses the lack of a physical link signal without requiring a system-wide reboot.

Incorrect:

A. Restart the server

• Restarting is a “blunt force” troubleshooting method that violates the principle of System Availability.

• In an AI governance context, unnecessary downtime for a production server (which might be hosting inference engines or active training jobs) should be avoided.

• Troubleshooting should follow a logical escalation path; jumping to a reboot before checking if the specific port is enabled is inefficient and can cause data loss or service interruption.

B. Configure the network on the server

• “Configuring the network” usually refers to higher-layer settings like assigning an IP address, subnet mask, or gateway.

• These configurations occur at Layer 3 (Network Layer) of the OSI model. However, link lights are a Layer 1 (Physical Layer) and Layer 2 (Data Link) indicator.

• If the NIC does not have a link light, it cannot communicate with the network at all. Configuring an IP address on an interface that is physically “down” will not resolve the lack of a link light.

D. Check the DHCP configuration

• DHCP (Dynamic Host Configuration Protocol) is used to automatically assign IP addresses once a link is established.

• Similar to Option B, DHCP is a higher-level service. A server cannot reach a DHCP server to request an address until after the physical link (represented by the link light) is active.

• Checking DHCP configuration is a valid step for resolving “No Internet” or “No Connectivity” issues, but it is irrelevant when the physical link itself has not been established.

Correct:

A. Cable management

• This is the most defensible solution because proper cable management (specifically the use of a Cable Management Arm or CMA) is designed to allow servers to slide in and out of a rack without straining or unplugging the power and data cables.

• In the AI life cycle, maintaining “high availability” for inference servers is critical. Accidental disconnections during hardware inspections can lead to unexpected downtime, which violates the Reliability and Resilience pillars of the AI Risk Management Framework (RMF).

• By organizing and securing cables with enough slack to move along a designated track, the administrator ensures that maintenance can be performed while the system remains “hot” or at least physically connected to its network environment.

• This represents an operational control that mitigates the risk of human error during the physical maintenance phase of the AI life cycle.

Incorrect:

B. Rail kits

• While a rail kit is the hardware that allows a server to be pulled out of a rack, it is actually the cause of the problem in this scenario rather than the solution.

• The rail kit facilitates the movement, but it does not manage the cables attached to the server. Without a cable management system attached to those rails, pulling the server out will almost always result in cable tension or disconnection.

• In an AIGP technical context, the rails provide Accessibility, but cable management provides Connectivity Continuity.

C. A wireless connection

• Using a wireless connection (Wi-Fi) for data center servers is generally considered a poor practice and a significant security risk.

• AI systems often require high-speed, low-latency data transfers (such as 10Gbps or 100Gbps Ethernet) to move large training datasets or handle high-request volumes; wireless technology cannot provide the necessary bandwidth or stability.

• From a governance perspective, wireless connections expand the attack surface, making it harder to secure the “Data in Motion” and violating the principle of Security by Design.

D. A power distribution unit

• A Power Distribution Unit (PDU) is essentially a sophisticated power strip for a server rack.

• While a PDU is essential for managing power delivery to the AI hardware, it does not prevent network cables from being pulled out when a server is moved.

• Even if the server remains powered on via the PDU, the “network connectivity” mentioned in the prompt would still be lost if the Ethernet or Fiber Optic cables are snagged and disconnected.

Correct:

C. Reinstalling the heat sink with new thermal paste

• This is the most defensible solution because the symptoms describe an overheating issue. When thermal paste dries out or a heat sink becomes unseated, the CPU temperature rises rapidly upon power-on. Once it hits a critical threshold (typically after a few minutes of operation), the system triggers an emergency shutdown to prevent permanent hardware damage.

• In an AI governance framework, System Reliability and Safety are paramount. High-performance AI workloads (like model training or real-time inference) generate significant heat. A failure in the cooling mechanism directly compromises the Availability of the AI service.

• Maintaining the physical cooling integrity of a server is a basic operational requirement to ensure the AI system can perform its functions without interruption, adhering to the principle of Robustness outlined in the NIST AI Risk Management Framework.

Incorrect:

A. Reseating any expansion cards in the server

• Loose expansion cards (like NICs or GPUs) typically cause the server to fail to boot entirely (failing POST) or cause intermittent “Blue Screen” errors/kernel panics regardless of how long the server has been running.

• Because the crash happens on a predictable time-based cycle (approximately five minutes) while the load is steady, it points toward a cumulative physical factor like heat rather than a static connection issue with a card.

B. Replacing the failing hard drive

• A failing hard drive usually results in data corruption, “Operating System Not Found” errors, or system freezes during specific read/write operations.

• A hard drive failure would not typically cause a clean “crash and reboot” cycle at a consistent five-minute interval if the load is steady. Furthermore, the technician confirmed configurations haven’t changed, suggesting the OS is loading correctly before the hardware-level shutdown occurs.

D. Restoring the server from the latest full backup

• Restoring from a backup is a software-level remediation. However, the prompt states that the technician confirmed “none of the configurations have changed” and the crash happens consistently regardless of software load.

• If the issue is physical (overheating), restoring the software will not fix the underlying hardware defect. In AI governance, performing a full restoration without diagnosing the root cause leads to unnecessary Downtime, which violates the goal of maintaining a resilient and available system.

Correct:

C. NTP is running on the database system

• Network Time Protocol (NTP) ensures that all systems in a network share a synchronized and accurate time.

• In the AI life cycle, Data Integrity and Auditability are foundational. Database synchronization relies heavily on “timestamps” to determine the order of operations and to merge data from different sources. If the system clocks are out of sync, the database cannot accurately reconcile updates, leading to synchronization errors.

• From a governance perspective, accurate timekeeping is essential for the Traceability of AI decisions. If a model makes a controversial prediction, logs must be perfectly synchronized across the infrastructure to reconstruct the event timeline for an audit or impact assessment.

• Ensuring NTP is running is the most logical FIRST step because it is a common root cause of “sync” issues that can be verified and fixed without altering the server’s core software or firmware.

Incorrect:

A. the correct firewall zone is active

• While firewall zones manage network access, a “zone” issue typically results in a complete Connection Refused or Timeout error rather than “synchronization errors.”

• If the database can attempt to update but fails specifically during the synchronization process, the network path is likely already open.

• In AI governance, while Security is a pillar, troubleshooting should focus on the specific nature of the error (synchronization) rather than broad connectivity settings.

B. the latest firmware was applied

• Firmware updates are part of Maintenance, but they are rarely the “first” step when troubleshooting a specific application-level error like database sync.

• Applying firmware is a high-risk activity that can lead to system downtime. AIGP principles of Risk Management suggest starting with non-disruptive configuration checks (like NTP) before proceeding to hardware-level updates that could further destabilize the AI environment.

D. the correct dependencies are installed

• Dependency issues usually prevent an application or database service from starting at all.

• If the database is currently running and attempting updates—but failing to synchronize them—the necessary software libraries and dependencies are likely already in place.

• Similar to Option B, auditing dependencies is a more complex task than checking a standard system service like NTP.

Correct:

D. Template

• A Template is a master image of a Virtual Machine that acts as a blueprint for creating new instances. It includes the operating system, specific configurations, and sometimes pre-installed software.

• In the AI life cycle, using templates is the most defensible way to ensure Model Reproducibility. When system requirements are similar, a template allows an administrator to deploy multiple identical environments in the shortest amount of time, as it eliminates the need to manually install and configure each VM individually.

• From a governance perspective, templates support Security by Design. An organization can “harden” a single master template (applying patches, security protocols, and compliance settings) and be confident that every AI system deployed from that template inherits those same protections.

• This reduces human error and ensures that the infrastructure meets the organization’s risk tolerance consistently.

Incorrect:

A. Snapshot

• A Snapshot is a point-in-time “picture” of a VM’s state, including its disk data and memory. It is primarily used as a temporary fail-safe before making changes or updates.

• While a snapshot can be used to revert a single VM to a previous state, it is not designed for the mass deployment of new VMs.

• Relying on snapshots for deployment is inefficient and does not scale well across the AI infrastructure compared to a dedicated template.

B. Deduplication

• Deduplication is a data compression technique that eliminates redundant copies of data to save storage space.

• While deduplication is highly effective in environments with many similar VMs (saving space on the backend storage), it is a Storage Optimization feature, not a Deployment tool.

• It does not help the administrator create new VMs faster; it only reduces the storage footprint after the data is written.

C. System Restore

• System Restore is a recovery tool used to return a computer’s system files and settings to an earlier point in time.

• This is a reactive Incident Management or maintenance tool, not a proactive deployment strategy.

• It cannot be used to create new, independent VMs to meet the administrator’s goal of expanding the server environment efficiently.

Correct:

A. setenforce 0

• In the AIGP body of knowledge, Security by Design requires robust access controls. However, during the initial configuration of complex services like MySQL, SELinux in “Enforcing” mode may block necessary actions, leading to configuration failures.

• The command setenforce 0 puts SELinux into Permissive mode. In this mode, SELinux does not block any actions but logs all “denials” that would have occurred.

• This is a critical troubleshooting step in AI governance to determine if a failure is caused by a security policy. Once the administrator completes the configuration and identifies the necessary policy exceptions, they should return the system to “Enforcing” mode to maintain the Integrity and Confidentiality of the AI database.

• The value 0 is the standard Boolean/numeric argument for the setenforce command to trigger Permissive mode.

Incorrect:

B. setenforce permissive

• While “Permissive” is the name of the state the administrator wants to achieve, setenforce generally accepts numeric values (0 or 1) or specific keywords depending on the version.

• In most standard Linux distributions used for AI hosting, setenforce permissive is syntactically incorrect; the command expects setenforce 0.

• AIGP technical proficiency requires knowing the exact syntax for modifying security states to avoid leaving infrastructure in an unstable or unintended configuration.

C. setenforce 1

• The output of the administrator’s initial check was “Enforcing.” Issuing setenforce 1 would simply tell the system to stay in Enforcing mode.

• Since the administrator is already having difficulty and the system is already enforcing policies, this command would not resolve the configuration blockage. It would maintain the “Hardened” state that is likely preventing MySQL from being configured correctly.

D. setenforce disabled

• setenforce cannot be used to “Disable” SELinux entirely. Disabling the security module requires modifying the configuration file (usually /etc/selinux/config) and performing a full System Reboot.

• From an AI governance perspective, completely disabling security modules is a “Risk Management” failure.

• Using Permissive mode (setenforce 0) is the preferred method because it maintains the logging of security events, whereas disabling it removes the Auditability of the system, making it impossible to track potential unauthorized access to AI data.