Server+ PBQ Lab: SOC Investigation and Incident Response War Room

Domain 1: Server Hardware Installation and Management — 18%

Server hardware has to support the workload, availability target, physical environment, and maintenance plan—not just meet a basic specifications list.

You’ll need to understand processors, memory, storage, RAID, network interfaces, power supplies, cooling, racks, cabling, firmware, hot-swappable components, and out-of-band management. Redundancy only helps when it removes a real single point of failure. Two power supplies connected to the same failed circuit don’t provide meaningful resilience. Watch for compatibility issues involving memory, controllers, interfaces, power requirements, and thermal limits. The exam expects you to choose hardware based on capacity and operational needs rather than simply selecting the fastest or most expensive component.

Domain 2: Server Administration — 30%

Server Administration is the largest domain and covers the routine configuration, maintenance, and management of server environments.

You’ll need to understand operating-system installation, storage configuration, network services, virtualization, containers, users, groups, permissions, automation, monitoring, patching, and ongoing maintenance. Study Windows and Linux concepts together, because the administrative goals often remain the same even when the commands and tools differ. Pay attention to scope and persistence. A temporary command-line change isn’t necessarily the same as a durable configuration that survives a restart. Follow the required end state: who needs access, which service must run, where data should be stored, and how the administrator will verify that the change worked correctly.

Domain 3: Security and Disaster Recovery — 24%

Security and disaster recovery work together to reduce both the likelihood and business impact of server failures or attacks.

You’ll need to understand system hardening, patching, authentication, permissions, encryption, certificates, firewalls, physical security, backups, high availability, business continuity, and disaster recovery. Study recovery point objectives and recovery time objectives, because they define how much data loss and downtime the organization can tolerate. A backup isn’t dependable simply because the job completed successfully. It must be protected, retained correctly, and tested through restoration. Know the differences among backup methods, off-site storage, immutable copies, replication, clustering, and failover. During security incidents, contain the threat while preserving evidence needed for investigation.

Domain 4: Troubleshooting — 28%

Server troubleshooting requires you to isolate failures across hardware, storage, operating systems, networking, security, and applications.

Start by documenting the symptoms, defining the affected scope, checking recent changes, reviewing logs and metrics, and testing the smallest useful theory. High CPU usage could come from an undersized workload, malware, a runaway process, or poor scheduling. Failed authentication could involve permissions, identity services, time synchronization, certificates, or network connectivity. Use hardware diagnostics, event logs, command-line utilities, monitoring platforms, performance counters, and storage tools to narrow the cause. Don’t stop when one error disappears. Verify the complete service path, confirm that monitoring has recovered, and document the fix so the same failure is easier to handle next time.