ABOUT THE AUTHOR

Daniel Lachance, CompTIA Security+, CompTIA A+, CompTIA Network+, CompTIA Server+, CompTIA Cloud Essentials, CompTIA Cloud+, as well as various Microsoft Azure and Amazon Web Services certifications, is the owner of Lachance IT Consulting, Inc., based in Halifax, Nova Scotia, Canada. He is the author of CompTIA Cloud Essentials+ Certification Study Guide, Second Edition, and co-author of CompTIA Security+ Certification Practice Exams.

Since the early 1990s, he has worked in various capacities as a computer programmer, network and server technician, and security analyst. He is also an experienced trainer, having delivered IT training online, in Canada, and in the Caribbean since the 1990s on topics ranging from Microsoft enterprise products (Active Directory, Hyper-V, System Center Configuration Manager, and Azure) to Amazon Web Services, UNIX, Linux, security, and networking.

He has recorded tech support videos for products such as Microsoft Azure, Amazon Web Services, and Microsoft System Center Configuration Manager and has recorded videos covering various cybersecurity and mobility topics.

He enjoys spending time with his spouse, Tammy; their children, Roman, Trinity, Abby, and Jacob; families and friends; and the family dogs, Dori and Louis. He also enjoys jogging, reading nonfiction, and listening to and playing various styles of music.

About the Technical Editor

S. Russell Christy is a technical trainer in Memphis, Tennessee covering a wide variety of products and specializing in computer maintenance, network and security, and Microsoft Office applications. For over 20 years, he has deployed new desktops and operating systems, servers, and network hardware and software, while simultaneously troubleshooting various hardware and software issues.

He holds a bachelor’s degree in business administration from the University of Memphis. He has also gained industry certifications in CompTIA A+, CompTIA Network+, CompTIA Server+, CompTIA Security+, CompTIA CySA+, Cisco CCNA CyberOps, MTA Windows Server Administration Fundamentals, Network Fundamentals, Security Fundamentals, Windows OS Fundamentals, Microsoft 365 Identity and Services, and Adobe Education Trainer.

Copyright © 2021 by McGraw Hill. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.

ISBN: 978-1-26-046992-9
MHID:      1-26-046992-1

The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-046991-2, MHID: 1-26-046991-3.

eBook conversion by codeMantra
Version 1.0

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.

Information has been obtained by McGraw Hill from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw Hill, or others, McGraw Hill does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.

TERMS OF USE

This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

CONTENTS AT A GLANCE

Chapter 1     Introduction to CompTIA Server+ Essentials

Chapter 2     Server Hardware

Chapter 3     Server Operating Systems and Server Roles

Chapter 4     Server Storage

Chapter 5     Server Network Communications

Chapter 6     Server and Network Security

Chapter 7     Troubleshooting and Performance Optimization

Chapter 8     Disaster Recovery Planning

Appendix A  About the Hands-on Exercises and Lab Setup

Appendix B  Objective Map

Appendix C  About the Online Content

Glossary

Index

CONTENTS

Acknowledgments

Introduction

Chapter 1     Introduction to CompTIA Server+ Essentials

Why This Book Is Relevant

Server Hardware Basics

Server Form Factors

Server CPUs

Server Memory

Buses and Slots

Virtualization

Environmental Factors

Storage

Network Concepts

Cables and Connectors

IP

Ports and Protocols

Server Operating Systems and Server Roles

Server Roles

Maintenance

Monitoring

Security Considerations

Hardening

Network Security

Troubleshooting and Optimizing Performance

Optimizing Performance

Troubleshooting

Preparing for the Worst

Cloud Computing

Cloud Computing Characteristics

Cloud Computing Deployment Models

Cloud Computing Service Models

Chapter Review

Questions

Questions and Answers

Chapter 2     Server Hardware

Server Form Factors

Tower Servers

Rack-mounted Equipment

Blade Servers

Server Components

BIOS

UEFI

CPUs

GPUs

Memory

Buses

NICs

Storage

USB

Power

Voltage

Wattage

Uninterruptible Power Supply

Environmental Controls

Temperature

Airflow

Humidity

Fire Suppression

Hands-on Exercises

Chapter Review

Server Form Factors

Server Components

Power

Environmental Controls

Questions

Questions and Answers

Chapter 3     Server Operating Systems and Server Roles

Server Roles

Infrastructure Roles

Other Server Roles

Virtualization Servers

Hypervisor Types

Hypervisor Host Configuration

Virtual Machine Guest Configuration

Server Installation

Server Licensing

Installing a Type 1 Hypervisor

Installing a Server Operating System

Server Administration Methods

KVM

Out-of-Band Remote Administration

In-Band Remote Administration

Server Documentation

Asset Life Cycle

Asset Inventory

Service Level Agreements

Other Documentation

Maintaining Servers

Patch Management

Proactive Maintenance

Reactive Maintenance

Hands-on Exercises

Chapter Review

Server Roles

Virtualization Servers

Server Installation

Server Administration Methods

Server Documentation

Server Maintenance

Questions

Questions and Answers

Chapter 4     Server Storage

Storage Technologies

Magnetic Hard Disks

Solid-State Drives

Hybrid Drives

Storage Tiers

Disk Interfaces

Optical Drives

Cloud Storage

Direct-Attached Storage

Network-Attached Storage

Storage Area Networks

Storage Capacity and Future Growth

Base 2 vs. Base 10

Where Did All the Disk Space Go?

Using Less Disk Space

RAID Configuration

RAID Levels

Storage Device Installation

MBR and GPT

File Systems

Sample Scenario 1

Sample Scenario 2

Hands-on Exercises

Chapter Review

Storage Device Characteristics

Disk Interfaces

Local and Network Storage

Storage Capacity Planning

RAID

Disk Initialization and File Systems

Questions

Questions and Answers

Chapter 5     Server Network Communications

The OSI Model

Cable Installation and Management

Cable Placement

Cable Labeling

Cable Types

Network Hardware

Network Interface Cards

Network Switches

Routers

Configuring IPv4

PAT

Static NAT

IP

IPv4 Addressing

Subnet Mask

Reserved Internal IP Address Ranges

When to Use Subnetting

Configuring IPv6

IPv6 Addressing

IPv6 Settings

IPv6 Transition Technologies

Network Infrastructure Services

Default Gateway

DNS Servers

WINS Servers

DHCP

TCP and UDP

TCP

UDP

Hands-on Exercises

Chapter Review

The OSI Model

Cables and Connectors

Network Interface Cards

IPv4 and IPv6

IP, TCP, and UDP

Questions

Questions and Answers

Chapter 6     Server and Network Security

Physical Security Measures

Premises Access

The Human Element

Authentication

Under Lock and Key

Logical Access Control

Groups

Dynamic Access Control

Roles

Rights and Permissions

File System Permissions

Peripheral Devices

Network Security

NAC

VLANs

Firewalls

Security Zones

PKI

IPSec

VPNs

Intrusion Detection and Prevention Systems

Hardening

Operating System Hardening

Hardware Hardening

Application Hardening

Data Security

Data and Mobile Devices

Encrypting Data at Rest

Tape Encryption

Secure Media Disposal

Hands-on Exercises

Chapter Review

Physical Security

Authentication

Logical Access Control

Network Security

Firewalls

PKI

IPSec

VPNs

Intrusion Detection and Prevention

Hardening

Data Security

Secure Media Disposal

Questions

Questions and Answers

Chapter 7     Troubleshooting and Performance Optimization

Troubleshooting Methodology

Identify the Problem

Establish a Theory of Probable Cause

Test the Theory

Establish a Plan of Action

Implement a Solution or Escalate

Verify Functionality

Perform Root Cause Analysis

Document the Solution

Hardware Problems and Solutions

Software Problems and Solutions

Storage Problems and Solutions

Windows Tools

Linux Tools

Network Problems and Solutions

Name Resolution Issues

Security Problems and Solutions

Malware Troubleshooting

Too Few Permissions

Too Many Permissions

Too Much Running

Confidentiality and Integrity

Performance Optimization

Hardware Optimization

Software Optimization

Network Optimization

Hands-on Exercises

Chapter Review

Troubleshooting Methodology

Hardware Problems and Solutions

Software Problems and Solutions

Storage Problems and Solutions

Network Problems and Solutions

Security Problems and Solutions

Performance Optimization

Questions

Questions and Answers

Chapter 8     Disaster Recovery Planning

Disaster Recovery

Alternate Sites

Data Replication

Business Impact Analysis

Business Continuity

Disaster Recovery Plan

Business Continuity Plan

Data Backup

Backup Types

Backup Media

On-premises Backup

Cloud Backup

Backup and Restore Best Practices

Hands-on Exercises

Chapter Review

Disaster Recovery Sites

Data Replication

Business Impact

Disaster Recovery Plan

Business Continuity Plan

Data Backups

Questions

Questions and Answers

Appendix A  About the Hands-on Exercises and Lab Setup

Lab Exercise Overview

Microsoft Windows

Linux

Requirements for Hands-on Exercises

Hardware Requirements

VMware Workstation 16 Pro

Acquiring Windows and Linux Installation Media

Lab Exercise Miscellany

Appendix B  Objective Map

Exam SK0-005

CompTIA Server+ Certification Exam SK0-005

Appendix C  About the Online Content

System Requirements

Your Total Seminars Training Hub Account

Privacy Notice

Single User License Terms and Conditions

TotalTester Online

Performance-Based Questions

Technical Support

Glossary

Index

ACKNOWLEDGMENTS

With each book project, I am reminded of the immense collective skill from the pool of talented folks required to make it all happen. I would like to thank McGraw Hill for providing the opportunity to create this book. Emily Walters, Lisa McClain, and Rachel Fogelberg were the guiding lights as to what I should be doing and when I should be doing it. I would also like to thank the rest of the wonderful team at McGraw Hill for making this project a great experience, resulting in a solid and fun book.

This book is chock-full of technical goodies, but credit must be given to S. Russell Christy for keeping the technical content consistent, accurate, and relevant—thanks, Russ!

I would like to say a special thank you to my family for enduring the many hours I spent preparing for and creating this book, as well as the endless techno-rambling I tend to fall prey to—love you guys!

INTRODUCTION

The CompTIA Server+ certification exam is becoming increasingly popular and showing up in IT job listings as a desired certification, not only for the management of physical servers but also the management of virtual servers running on premises and in the cloud. Topics formerly included in the discontinued CompTIA Storage+ certification are now included in CompTIA Server+. This change makes sense because of the close relationship servers have with storage, especially network storage.

CompTIA Server+ certification candidates must demonstrate a solid understanding of topics ranging from server hardware to server operating systems, networking and security, storage, virtualization, and cloud-based solutions. Today’s server administrators are responsible for remote administration of potentially hundreds of physical and virtual servers, whether in a small server room or in a large data center.

The primary skill required by CompTIA Server+ technicians is effective troubleshooting. Yes, it’s important to understand concepts and the sequence of steps required to yield a desired result, but the timely and efficient resolution of server-related issues is what distinguishes a casual server technician from an outstanding server technician. This book includes entire chapters dedicated to troubleshooting and disaster recovery.

Exam Details

You can book your English-language CompTIA Server+ SK0-005 exam online at www.pearsonvue.com/comptia/, or by phone with your local Pearson Vue testing center as of May 18, 2021. Additional languages will be added at a later date. Consult the web site to find the testing center nearest you, including directions to the center, or you can opt to have the test proctored for you in the comfort of your office or home.

You can use an exam voucher if you have one; either way, the cost is USD338. Payment methods include various debit and credit cards.

Preparing for the Exam

People learn in different ways. Reading comprehension is important, especially when it comes to end-of-chapter and master exam questions included with this book. Some folks learn best by doing; that’s why you’ll find hands-on exercises using both Windows and Linux at the end of each chapter.

It’s been proven that doing something related to a discussed topic helps our brains to understand how the topic is relevant and thus aids in retention.

The following list provides some general test-taking tips:

•   Have a positive attitude.

•   Learn the material in earnest; it is interesting and it can help your career.

•   Get a full night’s sleep for a few days prior to taking the exam.

•   Eat properly before taking the exam.

•   Don’t cram right before the exam.

•   Arrive at the testing center 15 minutes early.

•   Read all the questions and all the answer choices thoroughly.

•   With complex questions, ask yourself, “What is the question really asking?”

Taking the Exam at Your Location

When you schedule the exam online, you can choose to take the exam from anywhere you have an Internet connection and a computer with a microphone and web camera. You will receive instructions regarding how to prepare your exam room, and you will be prompted to upload a photo ID as well as pictures of the exam room. You will also receive instructions for ensuring that your computer meets the requirements for remote exam-taking. When the exam begins, the exam proctor will most likely ask you to show him or her your exam room through your computer’s web camera. You will not be allowed to have a watch on, phones within reach, or refreshments on your desk, nor will you be granted restroom breaks. Importantly, being interrupted by others could forfeit your exam, so make sure that you are completely isolated during the exam.

Taking the Exam at the Testing Center

After booking your exam, if you will be taking the exam at a testing center, take the time to ensure that you know how to get to the center on time, including the schedule of any public transportation you might take, and find out where you can park if you plan on driving.

You will need two pieces of ID at the testing center, including a photo ID. The testing center will also take a picture of you for your exam score report. You are not allowed to have a smartphone, books, or notes in the testing room.

Making the Grade

The required passing score for the CompTIA SK0-005 exam is 750 (the range is 100 to 900), and the exam consists of 90 multiple-choice and performance-based questions that you must answer within 90 minutes. Performance-based questions, or PBQs, test more than just your knowledge of CompTIA Server+ topics; they test that you can apply your Server+ knowledge to scenarios to solve problems. As has always been the case, there might be questions included on the exam that do not count toward your score. CompTIA does this occasionally to test out new content or question formats, but you won’t know which question(s) this applies to.

Table 1 lists the exam domains and their weight against the overall exam. Notice the emphasis on server administration and troubleshooting. For a detailed breakdown of CompTIA Server+ SK0-005 exam objectives, visit www.certification.comptia.org/certifications/server.

Table 1  CompTIA Server+ SK0-005 Exam Domains

If you are taking the exam at a testing center, you can use a provided marker and laminated paper to write notes and calculate values, such as valid subnet ranges. Each question has a Prev (previous) and Next button you can click to allow navigation throughout the entire exam. You can also flag certain questions for review; an item review screen will appear after the last question, where you can review some or all of your answers before ending the exam.

The exam contains multiple-choice questions that ask you to choose one or more correct answers, and you can expect scenario performance-based questions to solve some kind of server-based problem.

When studying for this exam, always keep the following in mind:

•   What is the most efficient way of completing an IT configuration task?

•   What sequence of steps must be followed to achieve a goal?

•   What is the first step in troubleshooting a specific issue?

•   What can be done to improve the performance or security of an IT system?

You will know right away whether you’ve passed the exam. If you fail on your first attempt to pass the exam, CompTIA does not require a waiting period before making your second attempt at the exam, but you will have to wait 14 calendar days if you want to make a third attempt. Using this book properly should not require a second exam attempt.

Using the Book

Welcome to CompTIA Server+ Certification All-in-One Exam Guide, Second Edition (Exam SK0-005)! By reading and understanding each chapter (including the questions), completing the included lab exercises, and taking the companion online practice exams, you will greatly increase your likelihood of passing the CompTIA Server+ exam. Refer to Appendix A for information about setting up the hands-on lab exercises.

This book maps to the official CompTIA SK0-005 exam objectives to help you prepare for the exam, but it also goes beyond the objectives to provide insight that will prove valuable when you are working in server-related environments.

Using the Objectives Map

The objectives map included in Appendix B has been constructed to help you cross-reference the official exam objectives from CompTIA with the relevant coverage in the book. The objectives map lists each exam objective exactly as CompTIA presents it and provides the corresponding chapter and section in which that objective is covered.

Online Practice Exams

This book includes access to practice exams that feature the Total Tester Online exam software test engine, which allows you to generate a complete practice exam or to generate quizzes by chapter module or by exam domain. This book also includes access to ten performance-based questions. For more information about the accompanying software and instructions on how to access the exam tool, see Appendix C.

CHAPTER 1

Introduction to CompTIA Server+ Essentials

In this chapter, you will

•   Learn about server hardware components

•   Learn how storage systems can be configured and provisioned

•   Review basic network concepts

•   Review the basics of monitoring and maintaining server operating systems

•   Review basic security concepts

•   Learn about troubleshooting and optimizing performance

•   Learn about disaster recovery

•   Explore cloud computing concepts

This chapter provides an overview of topics (all of the details follow in Chapters 2–8) that you’re sure to see on the CompTIA Server+ Certification Exam (SK0-005). We’ll also cover these topics in such a way that you’ll be well armed working in the IT field, whether you’re discussing network storage for cloud-based virtualized servers, determining specific server hardware that must be ordered, or working in a data center.

Data centers are neat—these big facilities host a wide array of IT services that are consumed by clients located hundreds, even thousands, of miles away. This is important with cloud computing. The equipment that cloud services run on is housed in data centers. You can bet that, among other certifications, a CompTIA Server+ certification is often preferred for data center jobs.

Why This Book Is Relevant

Because you’re reading this book, you probably already see the value in learning about the CompTIA Server+ Certification Exam. CompTIA is respected globally in the IT industry for its certifications for A+, Network+, Server+, Linux+, and many others. If you check out IT job listings on your favorite job-hunting site or ask people working at IT academic institutions, you’ll learn that many jobs require CompTIA certifications in one form or another.

Being a server expert is much different today from what it was in the 1990s, and that’s going back only 25 years or so! If you’ve been working in IT for a while, you might agree that there was a time when

•   We could know everything about a server operating system.

•   Arguably, overall server support was simpler because the software wasn’t doing as many things.

•   Arguably, overall server support was harder because we didn’t have great Internet search engines and video tutorials.

•   Applying patches didn’t occupy nearly as much of our time.

•   Malware infections weren’t nearly as ubiquitous.

•   Storage was contained physically inside the server case.

•   IPv4 was groundbreaking.

The CompTIA certification exam helps ensure that candidates really know what they’re talking about, including much more than just knowledge of servers themselves. You need to be familiar with server types and components, virtualization, IPv4 and IPv6 networking, cloud computing, operating systems, network storage, security, and troubleshooting. If all this interests you (and you need this certification to get a job!), then you are in the right place.

What kinds of jobs relate to the CompTIA Server+ certification? Countless, but let’s list a few general categories:

•   Data center IT technician

•   Server administrator

•   Network technician

•   Help desk technician

Remember that an understanding of the body of knowledge presented in this book is crucial for IT server and network technicians working for companies in any industry.

Server Hardware Basics

Everybody uses servers in one way or another, even if they don’t realize it—including teenagers posting content to social media from their smartphones, shoppers making online purchases, companies backing data up to the cloud, and Wall Street executives making decisions based on server-supplied data. Although the role of a server (the centralized serving of content and services to concurrent users over a network) hasn’t changed much over the decades, the scale of clients demanding quick and reliable access, the amount of data processed, as well as how servers are implemented, have changed. It’s not enough to know about servers themselves; we need to be aware of the entire ecosystem.

Servers offer some kind of a service to clients over the network, such as a web server offering a web site to a client’s web browser. The server’s role and number of clients it serves dictate how much horsepower is needed. The interesting part is that this is true whether you’re working with physical or virtual servers, on-premises or in the cloud.

The CompTIA Server+ Certification Exam will test your knowledge on the best hardware configurations given specific server scenarios. Even virtual machine servers, otherwise called instances, deployed in the cloud can be configured using different instance types, or sizes, which consist of factors like the number of virtual CPU cores (vCPUs), the amount of RAM, the number of attached disks, and so on. The great thing about virtual machines is that you can scale down, or reduce the amount of horsepower when appropriate, and in the cloud this saves you money.

Server Form Factors

Physical servers come in different sizes and shapes, as you’ll see in Chapter 2. For instance, tower servers take up more space than their slimmer cousins, blade and rack-mount servers. Blade servers take up the least amount of space.

Arranging physical servers requires knowledge of server racks with sliding rails for equipment, including, but not limited to, servers. This is a much better use of space than tower servers arranged on the floor. Blade enclosures make even better use of space. A blade enclosure is mounted into a rack, and blade servers slide into the enclosure for the utmost in space savings (what techies like to call “increasing data center server density”).

Server CPUs

Although a single CPU chip may suffice for a desktop, servers often have multiple physical CPU chips plugged into CPU sockets on the server motherboard. Each CPU chip consists of one or more cores. A CPU core has the same functionality as a physical CPU, and multiple cores can be embedded on a single CPU chip.

CPUs use high-speed L1, L2, and L3 cache memory for data and instructions to speed up processing. A 4 gigahertz (GHz) CPU slows down when data needs to get on a bus to get to a different component in the server—for example, down to 600 megahertz (MHz).

Where desktops and servers commonly use the more powerful Complex Instruction Set Computing (CISC) processors, mobile and consumer electronic devices need less power, which means less heat and cooling are required, so they tend to use Reduced Instruction Set Computing (RISC) processors. RISC chips are designed to use simple instruction sets, where a single instruction can be executed within a single clock cycle. Bear in mind that CPUs can have speeds of millions (megahertz) or billions (gigahertz) of clock cycles per second. A clock cycle is an opportunity for CPU instructions to be executed.

Server Memory

Scaling a database server to support larger datasets means adding memory (RAM). Virtual servers can be configured to use more RAM as needed, and in the cloud this is called resizing, which may require the virtual machine to be restarted. The extra RAM becomes available from other virtual machines running on the same underlying physical host that have RAM to spare at the time.

Memory is either static (SRAM) or dynamic (DRAM). SRAM is used in smaller amounts and is faster than DRAM, which requires a constant refresh of electricity. SRAM is used for L1, L2, and L3 CPU cache memory and not the main system memory in your server—that would be DRAM.

You need to know about the various types of RAM chips and which ones will work in your specific hardware. Some servers will accept only double data rate 3 (DDR3) memory, others use DDR4, and so on. Memory chips may also have to be added in pairs for efficient use by server motherboards with multiple CPU sockets. Modern motherboards color-code memory chip sockets to facilitate pairing.

Many servers use memory chips that can detect and fix memory corruption errors; this is known as error correcting code (ECC) memory. That’s why memory chips from a desktop, even though they may physically fit on a server motherboard, may not work correctly; they’re usually non-ECC chips.

Buses and Slots

Then there are expansion slots. Let’s say you need to add a 10Gb Ethernet card in your physical server. All slots are not created equally; an older PCI Express (PCIe) ×2 card will fit and work in a PCIe ×16 slot, for example, but it won’t work the other way around!

Cards have their own form factor, and you may even have run into this at home; some expansion cards seem to fit into a slot on the motherboard, but the card is too tall and the case won’t fit back on. Expansion cards need a bus to move data into and out of the card; servers use a variety of buses to move data around the system.

Thinner servers such as rack-mounts and blades won’t accommodate standard height expansion cards, but you can plug a daughter card into some rack-mount models that include slots that are oriented in such a way that standard-size cards can be used.

Blades get their additional capabilities such as storage and networking from other components plugged into the blade enclosure; you won’t find PCI network cards plugged into a blade server.

Virtualization

Virtual servers run as guests on a host (physical) computer, but they are still configured with virtual hardware. Some hypervisors (virtualization software) enable virtual guests to access physical hardware components directly, whereas others emulate hardware for the guest. Consider, for instance, how many vCPUs a virtual machine is configured with. Each vCPU maps to a CPU core and not a physical CPU chip.

A physical multiprocessor system enables each virtual machine to be configured with multiple vCPUs, but more vCPUs doesn’t necessarily mean better performance. This is because the hypervisor can get bogged down finding physical CPU time slots for all of the vCPUs; it really depends on what is running within the virtual machine—sometimes less is more.

Bumping up the number of vCPUs can also cause another problem: licensing. Many software vendors license their server-based products based on the number of physical or logical processors; talk to your software vendor to ensure your compliance with their license rules. Ideally, you’ll have an automated way to periodically inventory both hardware and software in use on servers; this is especially useful in a data center.

Environmental Factors

Adding virtual servers to a hypervisor host doesn’t make as much difference to power consumption and heat as does adding physical server hardware to a server room or data center. Careful arrangement of equipment can allow for optimal airflow, and ensuring adequate temperature and humidity control goes a long way toward ensuring that hardware runs at peak efficiency and has the longest life possible.

Heat and Air Flow

Imagine cramming dozens of physical servers into a tiny closet with no airflow—excessive heat and servers do not get along well. In Chapter 2 we will explore how to determine whether you have sufficient heating/ventilation/air conditioning (HVAC) for your hardware.

The more equipment you have, the greater the power draw, which means more heat is generated, which means more cooling is required. Using blade enclosures and server virtualization are two ways to reduce power consumption and heat.

When you’re working with a lot of equipment, it’s important to ensure that cool air is fed into devices and that the warmer resulting air is exhausted elsewhere and properly taken out of the room or cooled down again. Data centers normally send cool air from the floor up to rack components. Arranging racks of equipment in rows facilitates the creation of hot and cold aisles.

CPUs generate a lot of heat the faster they run. Heat sinks are placed over the CPU chip to dissipate heat away from the chip, and this can be accelerated with a fan to suck the warm air away from the chip. Liquid cooling is another server cooling option that uses cool water brought into the server. The heated water then leaves the server and is cooled externally.

Static Charges

An often overlooked aspect of environmental control includes electrostatic discharge (ESD) and fire suppression. Of course, large server rooms and data centers are designed with these things in mind, but smaller environments might simply convert the janitor’s closet into a server/wiring closet.

ESD is the frenzied rush of electrons between differently charged objects; this is bad news because it can damage sensitive electronic components. There are ways to reduce the possibility of ESD—basically, take steps to ensure that objects coming into contact with each other are equally charged.

Fire Suppression

In the event of an electrical fire, we do not want to use water as a fire suppressant. Server room and data center designs call for special construction and fire-suppression mechanisms not only to extinguish fires but also to minimize damage to electrical equipment. Chapter 2 will dive into proper ESD and fire-suppression practices.

Storage

Most individuals and businesses like to keep data around for a while. Servers can play the role of a centralized file repository. You need to know the variations on how disk subsystems can be configured and provisioned. This topic in all its glory was formerly covered in a separate CompTIA certification (Storage+) that no longer exists; now, all of the storage details are a part of the CompTIA Server+ certification.

Traditionally, servers housed local disks within their physical enclosures, otherwise known as direct-attached storage (DAS). This has evolved to the point where server storage needs are addressed by accessing storage over a storage area network (SAN) and in some cases in the cloud. A server might boot the operating system from DAS and store data on the SAN. Various SAN standards will be covered in Chapter 4.

There are various types of storage media, including traditional magnetic hard disks and the much sought-after solid-state drives (SSDs). SSDs have no moving parts, so they are quieter, consume less power, and are pretty quick; the downside is their price. But as with many other things, all storage media are not alike. Disk interfaces such as universal serial bus (USB), serial-attached SCSI (SAS), and Fibre Channel are important considerations when working with servers, as are disk characteristics such as input/output operations per second (IOPS) and storage capacity.

Redundant array of independent disks, or, depending on who you ask, redundant array of inexpensive disks (RAID) groups multiple physical disks together for two potential purposes: better performance and fault tolerance. If your hardware supports RAID, you can configure it at the firmware level; alternatively, software RAID organizes disks to work as a logical unit within the supported operating system. You need to understand RAID levels so that you can configure disks to best suit a particular server need. For instance, RAID level 1 (disk mirroring) increases the resilience to failure, but RAID level 0 (disk striping) improves performance. We’ll talk about how this works in Chapter 4.

EXAM TIP   Rest assured that successful CompTIA Server+ Certification Exam candidates are expected to know when to apply specific RAID configurations given a particular scenario. It’s not enough to know just the theory; make sure you have experience configuring and using various RAID configurations, even at the software level. A hands-on exercise in Chapter 4 can help guide you.

Once a server connects to storage of any kind, it’s business as usual—partitioning, formatting, and setting user permissions. In some cases, disk or file encryption may be needed to secure data further.

Network Concepts

Networking makes computing devices especially useful—the immediate accessing of services and the sharing of data. You may remember a time (the 1980s) when sharing data involved copying files to tape cassettes or floppy disks. In the early 1990s, we had modems with dial-up bulletin boards at what we now consider to be painfully slow transmission rates. How things have changed over the decades!

Cables and Connectors

A solid understanding of computer networks includes network hardware as well as network software. Ask yourself how many miles of cables or wireless transmissions are involved when you check the local news web site each morning—it really is amazing how it works, since there are so many different technologies actually talking to each other.

Cables and connectors matter as much to the average home Internet user as they do to IT pros installing cabling in office buildings, data centers, and provider networks. Chapter 5 will provide the nitty-gritty for fiber-optic and copper-based transmission media.

IP

On top of correctly configured network hardware, we have what most of us will configure and troubleshoot during our IT careers—Transmission Control Protocol/Internet Protocol (TCP/IP), usually referred to simply as IP. IPv4 and the newer IPv6 are collections of protocols that make things work on a network, but only if we’ve configured things correctly, such as the IP address, subnet mask, default gateway, and DNS server, among other settings.

NOTE   There is no IPv5; IPv6 is newer than the 1970s-era IPv4. IPv6 adoption on the Internet and in the enterprise continues to grow.

IPv6 uses a 128-bit address space compared to IPv4’s 32-bit address space. This means IPv6 has many more unique IP addresses compared to IPv4. IPv6 also includes built-in mechanisms that improve network quality of service (QoS) as well as security. IPv4 is used everywhere on the Internet, but IPv6 is not ubiquitous yet, so currently we can use tunneling technologies to get IPv6 traffic routed through the Internet.

It is only with a clear understanding of IP addressing and protocols in a multisubnet environment that you can properly support TCP/IP. For example, for a client workstation unable to connect to a server on a remote subnet, you might verify that name resolution and the default gateway (router) are configured correctly and reachable by the client.

Ports and Protocols

The application layer of the TCP/IP model contains protocols that enable direct interaction with users over the network, and they depend on lower layer transport protocols such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). Think of a web server listening for requests from client web browsers. Hypertext Transfer Protocol (HTTP) is an application protocol that listens for client requests on TCP port 80. You can think of a port as a listening channel that uniquely identifies a network service.

Port numbers are 16-bit values tied to TCP and/or UDP. Mathematically, there are 65,536 possible port numbers (2¹⁶); however, port 0 is reserved for internal use when assigning dynamic port numbers, and since we are starting at zero, the last valid port number is 65,535. The first 1024 (ports 0–1023) are called well-known ports and are reserved for common network services such as HTTP.

Other application protocols such as Simple Mail Transfer Protocol (SMTP) and Domain Name Service (DNS) use different port numbers—TCP 25 and UDP 53, respectively. Some network software will allow you to specify the port number that it listens on, while others will not.

EXAM TIP   Know the application layer protocols and their port numbers. Scenario-based questions may indirectly test your knowledge in this area. A much more exhaustive list will be presented in Chapter 5.

Server Operating Systems and Server Roles

When it comes to servers, a myriad of questions need answers. What is the server’s purpose? How many users will be connecting at once? How critical is it that the server stays up and running 24/7? Planning servers before jumping into the fun stuff is paramount.

Chapter 3 will address these questions and more:

•   Will the server operating system be installed onto physical hardware or in a virtual machine?

•   Does the server support basic input-output system (BIOS) or unified extensible firmware interface (UEFI)?

•   Are we installing a Windows, UNIX, or Linux operating system variant?

•   What type of disk partitioning and file systems should we use?

•   How will we remotely connect to the server?

•   How will patches be applied?

•   How will we secure the server?

Servers provide services and content to users. Companies can have their own servers running on their own equipment (on premises), but installing, configuring, and running various server roles in the cloud is becoming more and more common. The great thing about provisioning virtual server roles in the public cloud (on provider equipment) is how quickly you can get servers up and running without an investment in hardware. And, generally, you pay only for the time the virtual server is running—no wonder its popularity has soared!

NOTE   Throughout this book you will learn about not only Windows Server operating systems but also Ubuntu Linux, in both physical and virtual environments. This includes hands-on exercises and troubleshooting tips as well.

Server Roles

Infrastructure services such as Network Time Protocol (NTP), DNS, and Dynamic Host Configuration Protocol (DHCP) must be in place before anything else will work on the network. NTP assures that network devices agree on the time. DHCP delivers a valid IP configuration to hosts, while DNS is used to resolve friendly names (such as www.mheducation.com) to an IP address.

Directory servers provide a central network database of configuration objects, such as user accounts used for authentication. In a Microsoft Active Directory Domain Services (AD DS) environment, DNS must be functional for AD to be functional. In Chapter 3, we will install an AD domain and then explore the various ways that computers can be joined to the domain for centralized administration.

Application servers and web servers—how are they different? Traditionally, application servers run a server-side application that clients can access over the network in various ways. These days, the connection often uses HTTP or its secure counterpart, HTTPS. This means a web server needs to be on the server to handle these requests. The application server comes into play when developers build a business-specific solution on the web server—in other words, business logic, such as a payment processing service for e-commerce transactions. Planning for and configuring a web or application server have different requirements than an internal file server would.

File servers are file repositories in the enterprise. As IT administrators, we grant user permissions and set quotas on disk space usage. Having enough fast disks is a primary concern here, as is the network speed for file access. These days, cloud storage is all the rage; individuals and enterprises can provision storage as needed on provider equipment and pay only for the amount of disk space used. There are also hybrid solutions in which enterprise file servers can synchronize and even do backups to the cloud.

Maintenance

Once servers are humming along, we want to keep them going. Maintenance tasks, such as applying patches and firmware updates and ensuring that the server complies with organizational configuration settings and security policy, require continual attention, so just because the server is installed and configured doesn’t mean our work is complete. Your approach to these tasks will differ in a small company with a handful of servers compared to a large data center with thousands of servers. You’ll also need a way to connect remotely to servers through either a software or a hardware solution.

One way to ensure server uptime is to configure failover clustering. This involves at least two server nodes working together to provide the same service. If one cluster node fails, users are automatically switched over to the service running on a remaining node. Network load balancing (NLB) can be used to achieve optimal network performance, such as for a busy web site. It does this by distributing incoming traffic to the least busy back-end server hosting the web site. In the case of public cloud computing, failover and load balancing are often enabled with minimal effort, and in some cases they are automatically enabled!

Server Management

Long gone are the days of logging in directly at the physical server console. Instead, administrators connect remotely over the network to manage servers. This can be done using software or hardware solutions.

Software remote management solutions such as Secure Shell (SSH) depend on the server operating system functioning properly. But what if the server hangs and doesn’t respond? Then what?

Hardware remote management solutions such as Intelligent Platform Management Interface (IPMI) and Integrated Dell Remote Access (iDRAC) run independently of the operating system—so a server that hangs isn’t a problem. Hardware management solutions require a valid IP configuration so that the server can be accessed remotely.

Monitoring

Monitoring the performance of servers is an ongoing task. You’ll normally monitor some aspect of CPU, memory, disk, and network use. You might even enable alerts based on configured thresholds (“We’re almost out of RAM—do something!”). In a virtualization (and certainly a data center) environment, monitoring can be complex and must be configured carefully. We should monitor not only the aspects of physical virtualization hosts (hypervisors) but also the virtual machine guests that run on them.

Service Level Agreements

A service level agreement (SLA) is a contract between a provider and consumer stating expected levels of service, including details such as guaranteed uptime and response time. Data centers hosting IT services for numerous customers must diligently monitor server performance and network availability to ensure adherence to their SLA guarantees to their customers. A great example of this is an SLA for a public cloud service, such as Amazon Web Services (AWS) Simple Storage Service (S3) bucket cloud storage. In this case, the SLA is a contract between Amazon and its customer that guarantees a monthly uptime percentage such as 99.9 percent; if this uptime is not maintained, the customer receives a service credit, which is applied to their next bill.

Security Considerations

Servers can run on networks that are completely isolated from the Internet (air-gapped), or they can in some way be connected. Either way, servers need to be secured and the effectiveness of security controls continuously evaluated. In fact, a large percentage of security breaches actually occur from within the network.

Hardening

Hardening is an all-encompassing term used to describe how we lock down or tighten security. For servers this includes, but is not limited to, the following:

•   Placing servers in locked rooms/racks

•   Disabling unnecessary services

•   Applying patches

•   Running antimalware software

•   Adhering to the principle of least privilege

•   Enabling multifactor authentication

•   Auditing the use of sensitive data

•   Encrypting data in motion (network)

•   Encrypting data at rest (storage)

In a larger network, instead of hardening each server manually, we can apply security settings from a central configuration. Many tools can be used to accomplish this for Windows, UNIX, and Linux servers, such as Microsoft PowerShell Desired State Configuration (DSC) and Microsoft System Center Configuration Manager (SCCM).

Larger networks need an easy way to determine which servers are not compliant with organizational security policies. They also need an easy way to bring these devices into compliance. Enterprise tools such as SCCM have these problems covered. There are also cloud-specific tools that do the same thing, such as Microsoft Azure Policy compliance reports.

EXAM TIP   Knowing how to harden a handful of servers is very important. The CompTIA Server+ certification also applies to server management in large environments (such as data centers), so always keep in mind how you can apply configurations on a large scale.

Network Security

Everything would be so much more secure if computers didn’t connect to a network, but this is not reality. Fortunately, there are plenty of hardware and software security solutions to address network security.

The first step in protecting a network is to be very selective about which users and devices connect to the network. The Institute of Electrical and Electronics Engineers (IEEE) 802.1X security standard is focused on controlling access to a network. The idea is that network edge devices (virtual private network [VPN] concentrators, wireless access points, and Ethernet switches) do not perform authentication of connecting devices, but instead forward those requests to a central authentication server on a protected network.

In the case of a LAN device not supporting IEEE 802.1X, it can be disabled at the switch port level.

Authentication

Authentication is the proving of one’s identity. This applies to users as well as computing devices. For instance, a smartphone may be required to authenticate itself to a VPN before allowing user credentials.

Multifactor authentication combines at least two different categories of authentication, such as something you know (such as a PIN) and something you have (such as a smartcard). Combined with firewalls that control the flow of traffic into and out of a network, this is a good first step to securing your network.

PKI

Public Key Infrastructure (PKI) is a hierarchy of trusted digital certificates used for security. Certificates are issued from a trusted authority to users, devices, or services, and they can exist as files on a disk or settings located in a secured storage location (such as the Windows certificate store), or they may be written to a smartcard.

Certificates can be used in many ways:

•   Authenticate a smartphone to a VPN appliance

•   Digitally sign an app before it is published to an app store

•   Encrypt sensitive e-mail messages before transmission

You can get certificates from a trusted third party on the Internet, or you can create self-signed certificates for internal use. Chapter 6 will demonstrate how to install and configure a PKI using Windows Certificate Services.

Access Control

After successful authentication, authorization to use a network resource is granted based on access control lists (ACLs). There are many types of ACLs, such as those allowing access to a network and those that allow or deny access to a specific resource such as a file or a web site.

In the real world and on the CompTIA Server+ Certification Exam, you should be able to determine which permissions must be set to accomplish a specific goal, and you must also understand permission inheritance and precedence. The principle of least privilege states that only the permissions required to complete necessary tasks should be granted, and this must always be followed. We’ll go through this in detail, including a hands-on exercise, in Chapter 6.

Data at Rest

Securing transmissions to and from servers is always a good idea, but what about data once it reaches a destination and is stored on media? We keep hearing media reports about how millions of customers’ personal data has been compromised, and in some cases this involves a malicious user gaining physical access to a storage device.

Encrypting entire disk volumes or individual files and folders adds another layer of security. In the case of a stolen physical storage device, if encryption has been implemented properly, you needn’t worry—the device could serve as a lovely paperweight instead of as a source of valuable data. Encryption of data at rest is very useful with public cloud computing, where data center administrators are prevented from accessing cloud tenant data.

You can use tools to encrypt specific files and folders, or you may choose to encrypt entire disk volumes. Data backups should also be encrypted for additional protection.

When data reaches the end of its useful life, it needs to be disposed of in a secure manner, which may be required for regulatory compliance. This includes the remote wiping of mobile devices, soft and hard wiping of data, and the physical destruction of storage media.

Troubleshooting and Optimizing Performance

Solid troubleshooting stems from truly understanding the underlying technologies and the proper application of a troubleshooting methodology. Your ability to reproduce a problem and determine its scope is important to resolving issues quickly.

Optimizing Performance

Optimizing the performance of servers and their surrounding ecosystem can prevent negative incidents from occurring in the first place. In the enterprise, troubleshooting can involve poor performance. A server running out of disk space will slow the system to a crawl and could cause services to freeze, yet this could be caused by a lack of memory (RAM). Chapter 7 deals with both performance and troubleshooting, since often they are related.

Troubleshooting

We can apply the CompTIA troubleshooting methodology to real-world situations as well as to scenario-based exam questions. For instance, change only one thing at a time and observe the results of that change. Organizations use a variety of tools to document problems and their eventual resolutions, from recording this information in a spreadsheet to a full-fledged enterprise help desk ticketing system. Over time, this type of knowledge base can prove very valuable.

Hardware and Software Troubleshooting

One area you must be able to troubleshoot is hardware. All hardware eventually fails, in some cases prematurely due to excessive heat or perhaps ESD. Think of the dreaded “Operating system not found” message on a server. Is that a hardware problem, or is it a software problem such as a corrupt file? You have to ask yourself, “Self, what has changed since this last worked correctly?”

You’re more than likely going to encounter software rather than hardware issues in your IT career. Consider software misconfigurations. A specific server configuration may work well in one environment for a particular use, but it may fail spectacularly under different circumstances—it’s all about meeting business needs.

Other software problems can be much more difficult to troubleshoot—take random freezes, for example. You can still successfully troubleshoot unresponsive systems by viewing log files over time to determine whether or not a pattern exists, or to see what else on the system might have caused the problem.

Network Troubleshooting

Problems with server network communications can be a real pain in the neck; in some cases, such as with physical servers, we may need to be physically present to solve a problem. Hardware and software remote control solutions do nothing if we can’t remotely communicate with the server in the first place.

An enterprise IPv4 or IPv6 environment can be tricky to troubleshoot because the problem is specific to that implementation. Technical knowledge and network documentation (or details about network configurations including infrastructure) are central to snuffing out issues quickly when they arise. As always, we need to determine who (or what) is experiencing network communication issues. If it’s a single user or station, we know our infrastructure is good, so that enables us to focus our attention on the most likely problem sources.

Just because we can’t connect a network resource by name doesn’t mean the Internet is broken. Chapter 7 is chock-full of tips and tools at our disposal.

EXAM TIP   One way to ensure your success in passing the CompTIA SK0-005 exam is to know when to use a particular network troubleshooting tool or command. Of course, you are also expected to know how to use a tool to solve a specific problem.

Storage Troubleshooting

Because the former CompTIA Storage+ certification body of knowledge is now included in the CompTIA Server+ Certification Exam, not only do you have to understand the subject of storage, but you also have an obligation to know how to fix it when it’s broken or performing badly.

Equaling the other troubleshooting topics in Chapter 7, here you are required to know how to use the correct tools to solve storage problems that are interwoven with hardware (inappropriate RAID configurations), software and network issues (inability to connect to network storage), as well as matters of security (most often permissions).

Security Troubleshooting

This topic is interweaved with some form of hardware, software, or network troubleshooting. Think of an expired PKI certificate on a laptop that prevents that laptop from connecting to a VPN—sounds like a network issue, right? Well, it is, sort of, but it’s not the source of the problem.

The exam could include questions related to users being unable to access some type of network resource because of misconfigured permissions. Again, it sounds like it could be a network issue, but if other users can access that same resource, the problem may lie elsewhere.

Security-related hardware and software have log files that we can peruse to determine problem causes. But really, we can’t solve problems with silo thinking—in other words, we need to know about surrounding configurations (hardware, software, and network) and business processes to solve security problems effectively.

Chapter 7 will dive into malware and firewall issues, group policy configurations, and many other problems (and resolutions) associated with security.

Preparing for the Worst

Bad things happen. We can’t always predict how or when, but we can plan in advance for potential future negative incidents. This is the theme in Chapter 8.

Disaster recovery (DR) and business continuity relate to matters such as

•   Determining the impact of interruptions

•   Duplication (removing single points of failure)

•   Data replication

•   Data backup

•   Alternate locations to resume business operations

We can’t prevent all adverse situations, but we can minimize the unfavorable impacts against servers and business operations. This can succeed only with up-front planning and ensuring that technicians know their roles when it comes to incident response handling.

Cloud Computing

With cloud computing, everything old is once again new, at least when it comes to IT. All of the items discussed in this chapter (servers, storage, virtualization, networking, security, troubleshooting and performance optimization, and preparing for the worst) are IT topics that you may have years of experience with in an on-premises environment. If you use cloud computing services, some or all of this runs elsewhere on somebody else’s equipment and is accessible over a network. The same care in planning, managing, and securing IT services that applies to an on-premises environment applies in the cloud.

Cloud Computing Characteristics

Running a few virtual machines on a server on your network does not, in and of itself, constitute a cloud network. According to the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-145, five characteristics define cloud computing:

•   Measured service  Also called metered usage; cloud service usage is tracked for billing purposes much like electricity is.

•   Rapid elasticity  Cloud services can automatically expand to accommodate spikes and contract when things quiet down. This is referred to as autoscaling.

•   Resource pooling  Cloud provider network, compute, and storage infrastructure is grouped together and made available to cloud customers.

•   Broad network access  Cloud services are accessible over a network using any type of device. Most cloud services do not require special software to be installed on client devices.

•   On-demand self-service  Cloud users can provision or deprovision cloud resources without involving the cloud service provider.

Cloud Computing Deployment Models

There are a few different cloud deployment models, although they all exhibit the same five cloud computing characteristics just mentioned. Your agency or organization may choose to use one or more of these cloud types.

Public Clouds

A public cloud service provider (CSP) owns and manages the underlying equipment that cloud services such as storage, virtual machines, and databases run on. Examples of public CSPs include Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and Alibaba Cloud. This underlying equipment is housed in data centers around the globe. For example, AWS consists of data centers located in more than 190 countries.

Public clouds are accessible over the Internet to anybody who wants to sign up with a new cloud provider account, some of which are free and some of which are not. At the enterprise level, public cloud providers offer different types of cloud subscriptions with different service use and support options, and of course customers pay for the cloud resources they use, such as amount of cloud storage or how long cloud-based virtual machines are left running. At the individual level, some cloud services such as Dropbox, Gmail, and Microsoft OneDrive have free variations.

There are benefits for organizations that choose to use public cloud services:

•   Outsourcing IT infrastructure acquisition and management to the cloud provider enables the organization to focus more on using technology to solve business problems.

•   CSPs offer less up-front capital expenditures (CAPEX) in IT equipment acquisition, configuration, and management.

•   Consumers pay ongoing monthly operating expenditures (OPEX) for cloud service use as opposed to CAPEX when hosting all IT services on-premises.

•   Public cloud providers are constantly undergoing third-party audits to attain security accreditations.

Private Clouds

In a private cloud, the underlying equipment that provides cloud services is owned and used by a single organization, which constitutes CAPEX initially. Management of the private cloud infrastructure can be done by the owning organization, or it can be outsourced to IT consulting firms. The primary benefit of a private cloud is the owning organization having full configuration control of the entire infrastructure.

Remember that all cloud deployment models must adhere to the NIST’s five cloud computing characteristics. The measured service characteristic tracks cloud service usage. In a private cloud, this can be done simply to track usage by various users, departments, or projects within the organization, or it can be used for departmental chargeback, where the department in the organization pays the IT department for the use of private cloud services. Unlike a public cloud, private clouds are not available to anybody over the Internet willing to sign up with a new account.

Community Clouds

A community cloud is designed for limited access by groups with similar IT service and security needs, such as government agencies and specific industries such as finance or medicine that must comply with very specific regulations. Examples of community clouds include Microsoft Cloud for Healthcare and AWS GovCloud for American government agencies.

Hybrid Clouds

Hybrid clouds include any combination of public, private, and community clouds. An example is an organization hosting a private cloud on premises that uses cloud bursting to consume public cloud resources when private cloud resources are depleted.

Cloud Computing Service Models

Cloud services are grouped into categories, or models, based on the type of cloud service and where responsibility of managing that service lies. Anything as a Service (XaaS) is a general category of cloud-computing services, where the X represents a variable that could be a number of things. Table 1-1 describes the three most common cloud service models.

Table 1-1  Common Cloud Service Models

Chapter Review

This chapter provided insight into what the rest of this book offers. The body of knowledge covered for the CompTIA Server+ Certification Exam (SK0-005) is valuable for anyone working in an IT-related job.

Questions

1.   Which server form factor occupies the most space?

A.   Blade

B.   Virtual

C.   Rack-mount

D.   Tower

2.   What term is used to describe a virtualized operating system?

A.   Host

B.   Guest

C.   Hypervisor

D.   Load balancer

3.   Which two of the following items are related to HVAC?

A.   Perimeter fencing

B.   Ventilation

C.   Dual power supplies

D.   Temperature control

4.   How can ESD be reduced?

A.   Storing hardware components in a freezer

B.   Ensuring that objects coming into contact with one another have different charges

C.   Ensuring that objects coming into contact with one another have equal charges

D.   Storing hardware components in plastic bags

5.   What is the difference between DAS and a SAN?

A.   DAS enables the server to use network storage as if it were local. SAN storage is local to the server.

B.   DAS is local storage, and SAN is network storage.

C.   DAS is local storage specifically for virtual servers. SAN refers to cloud storage.

D.   DAS and SAN are separate terms that refer to exactly the same thing.

6.   What benefits do SSDs provide over magnetic hard disks? Choose two.

A.   Stronger encryption

B.   Increased file integrity

C.   Less power consumption

D.   Quicker file access

7.   You would like to improve disk I/O performance for data residing on a physical server. In accordance with your organizational policy, a server must remain running even if an operating system disk fails. The server is currently configured with RAID 1 for the operating system and data. What should you configure?

A.   Nothing; RAID 1 already offers the best performance.

B.   Remove the existing RAID configuration and enable RAID 0.

C.   Add disks to the server. Configure RAID 0 and create a file system. Move the existing data to the newly created file system.

D.   Add disks to the server. Configure RAID 0 and create a file system. Move the existing operating system file to the newly created file system.

8.   What role does a default gateway perform in an IPv4/IPv6 environment?

A.   It prevents local area network broadcasts from reaching other subnets.

B.   It is a router that allows traffic into and out of a network.

C.   It prevents multicasts from reaching other subnets.

D.   It is a router that performs domain name-to-IP address resolution.

9.   Roman is the server administrator for an international insurance company. The London office currently has Active Directory domain controller servers configured with IPv6. The Toronto office domain controllers are also configured with IPv6, yet replication over the Internet is failing between Toronto and London. What should Roman do to enable domain controller replication between the two sites?

A.   Enable IPv6 replication through group policy.

B.   Configure an IPv6 tunneling solution.

C.   Make sure the server PKI certificates allow domain controller replication.

D.   Ensure that servers at both locations are configured with the same default gateway.

10.   While capturing network traffic, you notice an excessive amount of traffic destined to a particular host on TCP port 25. What is one possible explanation for this?

A.   A mail server is being flooded with spam.

B.   A network broadcast attack is taking place.

C.   Users’ devices on the network happen to be issuing DNS queries at the same time.

D.   A web server is experiencing a large volume of concurrent visitors.

11.   Which of the following demonstrates an advantage of cloud computing? Choose two.

A.   Web servers can be scaled to handle heavy volumes of traffic.

B.   SLAs provide fault tolerance.

C.   Virtual machines and storage can be rapidly provisioned.

D.   SLAs provide guaranteed uptime.

12.   Your company’s e-commerce site is experiencing excessive traffic during the holiday shopping season. Being the server specialist, you have been directed to configure the site to improve user response time during peak loads. What should you configure?

A.   Network load balancing

B.   Failover clustering

C.   VPN

D.   Operating system virtualization

13.   Industry regulations require multifactor authentication to be used for sensitive server systems. Currently, users authenticate to these systems with a username and password. What should be done to ensure regulatory compliance?

A.   Nothing; multifactor authentication is already in use.

B.   Configure a PIN requirement in addition to current authentication settings.

C.   Use PKI certificates to secure authentication further.

D.   Enforce periodic password changes.

14.   What category of processor is used by mobile devices?

A.   CISC

B.   BISC

C.   RISC

D.   DISC

15.   You plan to use extra DDR3 memory chips for your server, which currently supports DDR4. What should you consider?

A.   DDR3 chips can be plugged into DDR4 sockets.

B.   DDR3 chips cannot be plugged into DDR4 sockets.

C.   The server BIOS will have to be updated.

D.   The server must use UEFI.

16.   You are manually deploying virtual machines into a private cloud. Which type of cloud service model does this apply to? Choose the best answer.

A.   SaaS

B.   XaaS

C.   PaaS

D.   IaaS

Questions and Answers

1.   Which server form factor occupies the most space?

A.   Blade

B.   Virtual

C.   Rack-mount

D.   Tower

D.  Tower servers take up the most space. A, B, and C are incorrect. Blade servers are essentially circuit boards that plug into a single server chassis. Virtual is not a server form factor. Rack-mount servers are installed in a tall metal rack along with other rack-mount servers.

2.   What term is used to describe a virtualized operating system?

A.   Host

B.   Guest

C.   Hypervisor

D.   Load balancer

B.  Virtualized operating systems are known as guests. A, C, and D are incorrect. Hosts are the physical machines on which guests run, and this is the same with hypervisor. Load balancers distribute incoming network traffic destined for a network service (such as a web site) to improve network performance.

3.   Which two of the following items are related to HVAC?

A.   Perimeter fencing

B.   Ventilation

C.   Dual power supplies

D.   Temperature control

B, D.  HVAC stands for heating, ventilation, and air conditioning, which encompasses ventilation and temperature control. A and C are incorrect. Perimeter fencing is a physical security measure, and dual power supplies provide hardware redundancy.

4.   How can ESD be reduced?

A.   Storing hardware components in a freezer

B.   Ensuring that objects coming into contact with one another have different charges

C.   Ensuring that objects coming into contact with one another have equal charges

D.   Storing hardware components in plastic bags

C.  Equalizing the charge between objects that will come into contact with each other reduces the flow of electrons, which can damage sensitive electronic components. A, B, and D are incorrect. ESD is not reduced by storing components in plastic bags or freezers.

5.   What is the difference between DAS and a SAN?

A.   DAS enables the server to use network storage as if it were local. SAN storage is local to the server.

B.   DAS is local storage, and SAN is network storage.

C.   DAS is local storage specifically for virtual servers. SAN refers to cloud storage.

D.   DAS and SAN are separate terms that refer to exactly the same thing.

B.  Direct-attached storage (DAS) means storage local to the server. A storage area network (SAN) is network storage, not the other way around; they are not the same thing. A, C, and D are incorrect. DAS can be used by physical or virtual servers. SANs are not specifically related to cloud computing. DAS and SAN are not one and the same.

6.   What benefits do SSDs provide over magnetic hard disks? Choose two.

A.   Stronger encryption

B.   Increased file integrity

C.   Less power consumption

D.   Quicker file access

C, D.  Solid-state drives (SSDs) have no moving parts and thus consume less power and generally provide quicker file access than magnetic hard disks. A and B are incorrect. Encryption and file integrity are normally configured at the software level and are not specific to SSDs.

7.   You would like to improve disk I/O performance for data residing on a physical server. In accordance with your organizational policy, a server must remain running even if an operating system disk fails. The server is currently configured with RAID 1 for the operating system and data. What should you configure?

A.   Nothing; RAID 1 already offers the best performance.

B.   Remove the existing RAID configuration and enable RAID 0.

C.   Add disks to the server. Configure RAID 0 and create a file system. Move the existing data to the newly created file system.

D.   Add disks to the server. Configure RAID 0 and create a file system. Move the existing operating system file to the newly created file system.

C.  RAID 0 is disk striping. The best course of action is to add disks to the server, configure RAID 0 and create a file system, and move the existing data to the newly created file system. A, B, and D are incorrect. The existing RAID 1 mirror does not provide a performance benefit, and it should be left alone for operating system file fault tolerance, but data should be moved to the new file system on the RAID 0 array.

8.   What role does a default gateway perform in an IPv4/IPv6 environment?

A.   It prevents local area network broadcasts from reaching other subnets.

B.   It is a router that allows traffic into and out of a network.

C.   It prevents multicasts from reaching other subnets.

D.   It is a router that performs domain name-to-IP address resolution.

B.  The default gateway is a router that allows traffic into and out of a network, in some cases based on conditions. A, C, and D are incorrect. Although routers do not forward broadcasts, that is not the role of the IP default gateway from an IP perspective. Multicast (group) traffic can normally traverse routers. Domain name-to-IP address resolution is a function of a DNS server.

9.   Roman is the server administrator for an international insurance company. The London office currently has Active Directory domain controller servers configured with IPv6. The Toronto office domain controllers are also configured with IPv6, yet replication over the Internet is failing between Toronto and London. What should Roman do to enable domain controller replication between the two sites?

A.   Enable IPv6 replication through group policy.

B.   Configure an IPv6 tunneling solution.

C.   Make sure the server PKI certificates allow domain controller replication.

D.   Ensure that servers at both locations are configured with the same default gateway.

B.  Roman should configure an IPv6 tunneling solution that will enable the IPv6 packets to traverse the Internet (an IPv4 network). A, C, and D are incorrect. There is no such thing as IPv6 replication. PKI will not enable replication; it is used for security purposes. Servers at each site should point to their local default gateway, not the same default gateway overall.

10.   While capturing network traffic, you notice an excessive amount of traffic destined to a particular host on TCP port 25. What is one possible explanation for this?

A.   A mail server is being flooded with spam.

B.   A network broadcast attack is taking place.

C.   Users’ devices on the network happen to be issuing DNS queries at the same time.

D.   A web server is experiencing a large volume of concurrent visitors.

A.  TCP port 25 is normally reserved for SMTP mail servers. Excessive traffic destined for the mail server could indicate spamming is taking place. B, C, and D are incorrect. Packets destined for port 25 are not broadcast packets; neither are they DNS queries, which use UDP port 53, or web server requests, which would use TCP port 80 or 443.

11.   Which of the following demonstrates an advantage of cloud computing? Choose two.

A.   Web servers can be scaled to handle heavy volumes of traffic.

B.   SLAs provide fault tolerance.

C.   Virtual machines and storage can be rapidly provisioned.

D.   SLAs provide guaranteed uptime.

C, D.  Although virtual machines can be provisioned without a cloud environment, one characteristic of cloud computing is the rapid deployment of services by users. Service level agreements (SLAs) can guarantee uptime, among other details; SLAs are contracts between cloud providers and consumers. A and B are incorrect. Web servers can be configured to handle heavy traffic volumes without cloud computing. SLAs themselves do not provide fault tolerance.

12.   Your company’s e-commerce site is experiencing excessive traffic during the holiday shopping season. Being the server specialist, you have been directed to configure the site to improve user response time during peak loads. What should you configure?

A.   Network load balancing

B.   Failover clustering

C.   VPN

D.   Operating system virtualization

A.  Network load balancing (NLB) distributes incoming traffic to the least busy of multiple back-end servers offering the same service. B, C, and D are incorrect. Failover clustering enables network services to continue even if servers fail, as long as at least one cluster node remains running. VPNs enable encrypted connectivity to a private network over an untrusted network. Operating system virtualization enables multiple OSs to run in their own virtual environments on the same physical host.

13.   Industry regulations require multifactor authentication to be used for sensitive server systems. Currently, users authenticate to these systems with a username and password. What should be done to ensure regulatory compliance?

A.   Nothing; multifactor authentication is already in use.

B.   Configure a PIN requirement in addition to current authentication settings.

C.   Use PKI certificates to secure authentication further.

D.   Enforce periodic password changes.

C.  Multifactor authentication requires multiple authentication “categories”; in this case, something you know (username and password) and something you have (PKI certificate). A, B, and D are incorrect. Multifactor authentication is not in place when only the something you know category is in use, which is also true even if you enable PINs or enable periodic password changes.

14.   What category of processor is used by mobile devices?

A.   CISC

B.   BISC

C.   RISC

D.   DISC

C.  Reduced Instruction Set Computing (RISC) processors are often used by mobile devices because of their low power requirements. A, B, and D are incorrect. Complex Instruction Set Computing (CISC) processors tend to be used in desktops and servers where more complex processing is required. BISC and DISC are fictitious terms.

15.   You plan to use extra DDR3 memory chips for your server, which currently supports DDR4. What should you consider?

A.   DDR3 chips can be plugged into DDR4 sockets.

B.   DDR3 chips cannot be plugged into DDR4 sockets.

C.   The server BIOS will have to be updated.

D.   The server must use UEFI.

B.  DDR memory chips are not interchangeable with other DDR version standards. A, C, and D are incorrect. DDR3 chips cannot be physically plugged into DDR4 sockets. The BIOS and UEFI are irrelevant to whether DDR3 chips can be used in DDR4 slots.

16.   You are manually deploying virtual machines into a private cloud. Which type of cloud service model does this apply to? Choose the best answer.

A.   SaaS

B.   XaaS

C.   PaaS

D.   IaaS

D.  Infrastructure as a Service (IaaS) includes cloud-based storage, network components, and virtual machines that are manually deployed and managed by the cloud customer. A, B, and C are incorrect. Software as a Service (SaaS) refers to end-user productivity software accessed over a network in a cloud. Anything as a Service (XaaS) is a catch-all phrase describing a cloud service accessed over a network. Platform as a Service (PaaS) refers to cloud services related to software development, network directory services, and databases where the underlying virtual machines and software are automatically provisioned and not directly under the control of the cloud customer.

CHAPTER 2

Server Hardware

In this chapter, you will

•   Learn about server form factors: tower servers, rack-mounted servers, and blade servers

•   Learn how BIOS works

•   Learn how UEFI works

•   Review the basics of CPUs and how they handle data

•   Review the different types of memory

•   Learn about bus types

•   Learn about NICs

•   Review storage types

•   Learn about power and environmental controls

Server hardware isn’t just about the components inside the server—it’s also about the size of the server case and its components. This chapter will cover what you need to know when ordering and replacing server components.

Server Form Factors

Physical servers and their parts come in a variety of shapes and sizes, or form factors. Not all components will fit into every server. For example, adapter cards that fit well within a server tower will not fit into a blade server, and a tower server can’t be rack-mounted in a server room rack.

Form factors also apply to computer cases, power supplies, motherboards, expansion cards, and so on. The dimensions of these pieces determine which ones fit together properly. Data centers need to fit as many servers as possible within a finite amount of space, so increasing server density is possible using smaller server form factors.

Other components such as PCI Express (PCIe) expansion cards adhere to industry-standard form factors. Perhaps you want to add a 10 Gbps (gigabits per second) Ethernet network card to your rack-mounted server. This could be a problem, because a standard PCIe card won’t fit within most rack-mounted servers, which are much thinner and smaller than tower servers.

Server technicians need to know all the details related to the types of servers they are responsible for. Let’s say it’s the first day on the job for a CompTIA Server+ certified tech. How can this person know what servers are in place? Clearly, one way is to inventory servers physically in server rooms or data centers, but larger enterprises will have automated solutions that inventory physical and virtual servers and store the results in a database that can be queried and reported on. Virtual servers, of course, don’t have form factors.

Tower Servers

Tower servers have been around for a long time, and the tower is what most people think of when they hear the word “server.” Powerful desktop computers (such as those used by gamers) are often towers. This server form factor isn’t screwed into any type of mounting device; it is a standalone computer that can be easily moved without removing screws or sliding it out of a rack.

In this server form factor, all server components are housed within a single case that can sit directly on the floor or on a desk. Server components are easy to find, because this is a tried-and-true hardware technology.

Adding dedicated components such as disk storage to the server is easy, because there is plenty of physical space inside a tower server. This isn’t the case with other server form factors such as blade servers, however, although blades can use rack-mounted storage devices; the storage isn’t physically installed inside the blade. Imagine trying to accommodate hundreds or thousands of tower servers in a server room or data center: the cost of real estate alone would be tremendous! Suffice it to say that tower servers don’t scale well. They take up a lot of space and they can’t be rack-mounted, as you can see in Figure 2-1.

Figure 2-1  Dell PowerEdge T620 tower server, courtesy of Dell, Inc.

Tower servers are often used in smaller offices. If IT budgets are stretched, towers might be an attractive option, because even a standard desktop PC could be configured with a server operating system—but, of course, this isn’t designed for large-scale use.

Another possibility is a central IT office that preconfigures servers to be used in branch offices. Perhaps only a single server is needed at a branch office to localize user access to server services, so it might make sense to ship a tower server to that location instead of purchasing expensive server racks and a single-rack mounted device.

When it comes to component redundancy, most tower servers fall short. They can accommodate standard hardware components, but they don’t often come with redundant power supplies. There’s also the issue of power and data cables. If your server room contains only towers, you may find it tricky to organize all of the cables. Server racks have conduits into which cables are easily and neatly arranged, which makes labeling and troubleshooting easier. Main distribution frames (MDFs) are cable racks that organize data cabling from intermediary distribution frames (IDFs), which organize cables plugged into equipment. (Just make sure you label both ends of each cable!)

Rack-mounted Equipment

The 1990s produced the server rack form factor courtesy of Compaq, which was acquired by Hewlett-Packard in 2002. Computing and the Internet were taking off, and many companies realized they needed servers on premises. Nowadays that has shifted to running servers in the public cloud on somebody else’s equipment.

Rack-mounting increases the potential server density in a server room or a data center, and using this equipment can increase security, because most racks have front and back doors that can be locked. In a large data center that accommodates multiple customers or tenants, controlling physical access to rack-mounted servers and equipment is important. The size of your enterprise and its data requirements, and the size of the data center, determine how many racks you can use. Server technicians will sometimes need to identify a physical server is a server rack; unit identification (UID) LED lights on the front and back of a rack-mounted server will blink when the server is being managed remotely or when the UID button is physically pressed on the server. This is useful when technicians must access the back of a rack-mounted server and want to ensure they are working on the correct server.

Special cases and rails are used so that rack-mounted equipment can be easily inserted and removed from racks. Rack-mounted servers ship with their cases, and sometimes they also include rails and the screws needed to secure the rails on the rack.

Rack-mounted Servers

Rack-mounted servers will appeal to those who prefer tidiness and organization; they are essentially thin computers (from 2 to 12 inches wide) that are designed to be stacked vertically in a metal framework, or rack. This keeps things tidy and uses a minimum of space, so this form factor is definitely scalable. Rack-mounted equipment can be blocky, with sharp edges, however.

To assist in removing single points of failure, rack-mounted servers normally have dual power supplies. There are normally at least two network cards and in some cases management ports, and all of these connections are on the back of the device. Figure 2-2 shows ports on the front of the server; these allow a keyboard, mouse, video display, or a KVM (keyboard, video, mouse) switch to be connected.

Figure 2-2  Dell PowerEdge R515 rack server, courtesy of Dell, Inc.

Racks

Full metal racks can be heavy, and server room and data center construction must account for that by including floors that can safely handle the weight. And because you don’t want racks tipping over, balancing and bolting them to the floor is recommended.

Most racks are 19 inches wide (they do come wider), and they often use metal sliding rails that the servers and other types of appliances (such as network firewalls, storage enclosures, and so on) neatly fit into. Racks may not come with rails, so you may have to acquire rail kits. Rack-mounted equipment such as servers usually comes with a rail kit. (Be careful not to get pinched when inserting into or removing equipment from these sliding rails.)

Not all racks are equal, and they are available in different widths and heights. You may use one rack to accommodate servers and another to accommodate storage arrays. Rack-mountable devices use their own units of measurement for height, called rack units (U)—1U is 1 3/4 inches, 2U is 3 1/2 inches, 4U is 7 inches, and so on. This measurement is a standard that refers to the vertical distance between the holes in the rack to which rails and rack-mounted equipment are secured. A single rack-mounted device may be from 1U up to 7U in height. Most racks have a maximum of 42U (see Figure 2-3). When you’re ordering rack-mountable servers, the specs will detail how many Us the enclosure requires so you can plan placement within the rack.

Figure 2-3  A 42U server rack can contain various pieces of equipment.

Now, because you can place many servers together in a rack, it just makes sense to place server storage appliances, power sources (including UPSs), and network cables in the rack, too. Too many times I’ve seen messy racks with cables hanging everywhere, both in front of and behind the rack; not only is this a safety hazard, but tracing cables when troubleshooting will be next to impossible!

Power distribution units (PDUs) provide power outlets to racks in server rooms and data centers. To eliminate a single point of failure, redundant PDUs should be plugged into separate circuits. To extend this point, redundant server power supplies should each plug into separate PDUs. Data centers normally have alternate sources or providers of power, such as diesel generators, in the case of a power outage.

Because many different types of items can draw power from PDUs, you should check your PDU’s rating to ensure that your equipment doesn’t draw more power than the PDU’s load capacity can accommodate.

Cable Management Arm

A cable management arm is a metal or plastic folding component that is attached to the back of a rack-mounted device. All cables from the device (power, network, and so on) are fitted into the arm, which serves as a conduit or trench in which the cables are placed. You would also normally use cable zip ties to bundle together cables from a device. (A standard rack-mounted server has dual power supplies and at least two network cards, so that’s four cables right away for a single device.) When you pull out a rack-mounted device (on the sliding rails), the cable arm expands so that you don’t pull the cables out.

After your rack-mounted devices and cabling are in place, use rack fillers (blanking panels) to cover empty spaces in the rack. These, in addition to cable management arms, ensure that fan intake vents are not blocked. This can improve airflow, which can also save money by saving energy in the long run. Rack fillers are also measured using the U system and are available with venting holes.

Blade Servers

Blade servers make me think of Star Trek: a technician inserts a highly sophisticated card into a slot to prevent the destruction of the USS Enterprise. And that’s essentially what the blade server form factor is—a circuit board containing its own processors, memory, and network capabilities, and, in some cases, a small amount of storage, but no power supply or cooling mechanisms. Blade servers cannot run on their own. Most blades have a USB connector on the front in case you want to connect external components such as a DVD drive.

This small server form factor (Figure 2-4) will most likely replace rack-mounted servers at some point. Large data centers can increase their server density using blades, so scalability is not a problem. Like everything in IT, it’s a tradeoff—sure, you can fit more blades than towers in a fixed amount of space, but towers are cheaper and easier to expand if you need expansion cards or additional storage.

Figure 2-4  Dell PowerEdge M520 blade server, courtesy of Dell, Inc.

Blade Enclosure

A blade enclosure is a proprietary chassis that can house several blade servers from the same vendor, and it can measure from 6U to 12U. Blade servers slide into the blade enclosure. The enclosure provides

•   Temperature control mechanisms, including fans

•   Power

•   Network connectivity

•   Storage connectivity

•   Server remote management connections

Within the enclosure, the backplane connects server and I/O blades. I/O blades (or cards) can provide faster network connectivity, storage for blade servers, management capabilities, and other things. The midplane is a printed circuit board (PCB) with server blades that connect on one side (the front) and other components accessible on the other side (the back). If, for example, 10Gb network switching is required, you would have to use a specific midplane with this support.

Note that some manufacturers provide backplane and midplane redundancy to reduce single points of failure. Blanking panels are used where there are empty slots in the enclosure for better cooling and airflow.

Server Components

Whether you are working with tower, rack-mounted, or blade servers, they all have components that give them specific functionality:

•   Multiple processors (each with multiple cores)

•   Memory (RAM)

•   Storage (local and/or network accessible)

•   Network connectivity (servers often have multiple cards)

•   Management capabilities (for blade systems or hardware-level remote control)

Firmware is essentially software stored in a chip, and it’s used all over the place—a server’s motherboard BIOS, smartphones, and expansion cards, to name a few. Like operating system or application software, firmware comes in different versions with different capabilities and needs to be updated periodically. Updating server motherboard firmware can sometimes update the unique 128-bit universal unique identifier (UUID) that is used in firmware as a global server identifier for asset-tracking purposes.

Hardware problems can sometimes masquerade as software issues. For instance, flawed firmware code could cause server operating system instability. The solution is sometimes as simple as downloading and applying a firmware update from the manufacturer’s web site.

Even though it is considered obsolete, some manufacturers still supply an MD5 hash value on the download web page that you can recompute after downloading to verify that the file, such as a firmware update, hasn’t been changed. MD5 has been superseded by Secure Hashing Algorithm (SHA), so you’re more likely to see SHA hashes than MD5. Plus, when updating firmware, you need to be sure you’re applying the correct version of the update. The big guys (Dell, HP, IBM) often offer rollback options if you don’t like the applied firmware update.

BIOS

The basic input-output system (BIOS) is firmware built into a circuit board such as a motherboard or a RAID (Redundant Array of Inexpensive Disks) disk controller. BIOS has been around for decades. This is the magic that kicks in the moment you turn on the power for your server or when a card initializes.

When starting up, the server BIOS checks critical hardware components such as power, CPU, RAM, and video to make sure they are in place and functional. If the components are not functional, you’ll get various beep codes or error numbers and messages, provided video is working. This is called the power on self test (POST). Assuming things are working, the BIOS then checks the master boot record (MBR) to hand control over to an installed operating system.

Disks are initialized on a computer as either MBR or GUID Partition Table (GPT), depending on operating system support. There is only one copy of the MBR on an MBR disk, and it sits on the first sector of the disk before the first disk partition. GPT disks store multiple copies of this data throughout the disk for additional resiliency.

MBR disks are limited to four partitions. GPT disks can have up to 128 partitions on a Windows system. So on a unified extensible firmware interface (UEFI) system, booting from a GPT disk is possible as part of the POST.

The complementary metal oxide semiconductor (CMOS) is essentially the specific configuration of hardware settings supported by the BIOS. For example, you might change the boot order on your server to boot from USB (requiring a password of course!) first, and then from a local hard disk. Or you might enable or disable the CPU execute disable (XD) bit. With this option enabled, the processor flags specific areas of memory where data can reside and code cannot execute. The BIOS has the capabilities, and the CMOS retains your configuration of those capabilities. Figure 2-5 shows a basic BIOS configuration screen.

Figure 2-5  BIOS screen

But how can you configure CMOS settings? In other words, how can you configure the BIOS? It depends on the BIOS manufacturer. The following list shows a few common BIOS manufacturers:

•   ASUS

•   Phoenix

•   IBM

•   Dell

•   HP

If you’re using a Dell system, for example, when the system is first powering up, you can press the F2 key on the keyboard to enter the BIOS settings. Some BIOS firmware will briefly display a message telling you what to press. Properly configured servers will require a password before you can view or change these settings.

NOTE   Not only do motherboards have BIOS settings, but expansion cards, such as disk RAID controllers, have BIOS settings, too. Refer to the manufacturer’s documentation to determine how to enter specific BIOS settings. Documenting BIOS configurations is an important part of proper server management and facilitates troubleshooting. Make your life easier!

UEFI

Unified extensible firmware interface (UEFI) is the new BIOS: BIOS is old, and UEFI is new. On PCs, UEFI has become common over the last few years, but Apple computers have used UEFI for a long time.

Here’s a list of a few UEFI features that most BIOS firmware does not support:

•   Graphical interface with mouse support

•   GPT hard-disk support, including booting from GPT

•   IPv6 support during boot

•   Support for Secure Boot

•   Support for new modules for additional functionality

Let’s zoom in to the UEFI Secure Boot feature for a moment. If malware can inject itself into the pre-boot operating system (OS) environment, then even the most secure OSs can be compromised. Think about it: Code is in place before the OS boots and then has direct access to hardware. It sounds nasty, and it is. Secure Boot prevents untrusted executable code from running before the OS initializes. Digital signatures are used to validate trusted code.

EXAM TIP   Keep in mind that some Linux distributions do not support Secure Boot; you may be quizzed on this in the exam. To install those Linux operating systems, you first have to disable UEFI Secure Boot by entering UEFI settings on your server.

CPUs

The central processing unit (CPU) is the brain of the server and comes on a chip. Of course, to handle more intense workloads, having more brains helps. The first version of a CPU is referred to as step 0. As the manufacturer releases the same CPU with improvements, the step value increases—for example, from 0 to 1. Adding more horsepower to a server is called scaling up, while adding additional servers to handle a workload is called scaling out.

CPU Architecture

Although most modern CPUs have a 64-bit data path, you may also come across 32-bit. Newer server operating systems, however, such as Microsoft Windows Server 2012 R2, support only 64-bit. The 32-bit machines have a maximum addressable memory limit of 4GB, while 64-bit machines have a limit of 16EB (exabytes).

Modern mobile devices use Advanced RISC Machine (ARM) processors. A few examples include Apple iPod, iPad, and iPhone products; Raspberry Pi devices; and Microsoft Surface tablets. ARM processors come in both x86 (32-bit) and x64 (64-bit) flavors.

If you plan on running a hypervisor (such as Microsoft Hyper-V or VMware vSphere Hypervisor), your CPUs must support hardware virtualization. AMD processors must support AMD Virtualization (AMD-V), and Intel processors must support Intel Virtualization Technology (Intel VT).

When planning server hardware, you should also consider the CPU speed. Naturally, a 4 GHz processor gets things done more quickly than a 2 GHz processor. But this speed refers to how fast instructions are processed internally; you have to ask yourself, “How quickly can data get to and from the CPU on the motherboard?” The following illustration shows a CPU in its motherboard socket.

Waiting for the Bus

Buses move data among the various components within a computing device, so every server motherboard always includes several buses, such as a PCIe expansion card bus and the main system bus. The bus speed (usually expressed in megahertz, or MHz) is different from the internal CPU speed, and it determines how quickly data gets to and from certain areas of the system.

CPU Cache

CPUs have small amounts of high-speed memory, or caches, to speed up the execution of anticipated CPU instructions—or, said differently, to increase the hit rate. The hit rate indicates that when the CPU needed instructions or data, it was retrieved from cache (a hit) instead of from another slower location (such as finding data in L1 cache instead of L2). L1, L2, and L3 caches are common in today’s server hardware: L1 is the fastest and (the less common) L4 is the slowest (and largest).

The L1, L2, and L3 caches are typically built into the processor, while L4 uses main system memory. The reason L1 cache, for example, is faster than normal system memory is because it uses static RAM (SRAM) as opposed to dynamic RAM (DRAM) or synchronous DRAM (SDRAM). SRAM uses transistors to retain data, which speeds up data access. Table 2-1 shows common CPU cache sizes, which will vary between CPUs and motherboards. Bear in mind that L3 and L4 cache memory is used by all CPU cores for CPU chips in a socket.

Table 2-1  CPU Cache Sizes

The least recently used (LRU) caching algorithm ensures that cached items are listed in the order they were processed, so that the oldest used items can be removed from cache, thus making space available for new items. LRU refers to how older cached items are replaced with new items. Most recently used (MRU) algorithms do the exact opposite: the newest items in cache are removed when space is needed. The specific type of processing requirement determines whether LRU or MRU is appropriate.

A server can have multiple identical physical CPUs working together via symmetric multiprocessing (SMP), but of course the server motherboard must have sockets to accommodate the CPUs. So by distributing work among a group of CPUs, you reduce the amount of time it takes to complete the work. Reduced Instruction Set Computing (RISC) refers to processors that are very efficient in that they are designed to work with simpler and smaller instruction sets, resulting in a smaller chip size than traditional Complex Instruction Set Computing (CISC)–based processors. Today, RISC processors are often found in mobile devices.

On the server side of things, Table 2-2 outlines common CPU sockets and processors. You can’t just plug any CPU into any socket; they have to match!

Table 2-2  CPU Sockets and Processors

Taking the discussion a step further, each physical CPU chip can have multiple cores—essentially, multiple CPUs within the same chip plug into a single motherboard socket, which means more computing power while using less space than an SMP system. Figure 2-6 shows a single CPU socket Windows host with four internal cores and with L1 and L2 caches.

Figure 2-6  Multicore CPU and cache listing

NOTE   When you’re working in the field, SMP and multicore systems present the CPUs in the exact same way to operating system monitoring tools such as the Windows Task Manager.

GPUs

Modern graphic computing demands can sometimes require hardware dedicated to processing complex visuals related to gaming, 3-D modeling, video rendering, high-resolution image editing, and so on. Graphics processing units (GPUs) are specialized processors designed to handle computationally intensive graphic operations, thereby freeing up the CPU(s) in the server to process other instructions.

GPUs can be embedded within the server motherboard as part of a chipset or are available as expansion video cards, and they can also have dedicated video memory to isolate graphic operations from nongraphic operations handled at the CPU level. Specialized high-end desktops are more likely to contain GPUs than servers, such as for video animation; however, remote desktop access to a server could require the server to be configured with GPUs depending on the type of work being done. Typical smartphones also use GPUs for modern graphic rendering, but to a lesser degree than specialized GPU cards.

Cloud-computing customers can also benefit from running cloud-based virtual machines or remote desktops (Desktop as a Service, or DaaS) with enhanced GPU capabilities. This normally incurs a greater usage cost than non-GPU–enhanced virtual machines running in the cloud.

Memory

Random access memory (RAM) is the electronic volatile memory used by running programs; it needs electricity to retain data, unlike disk storage devices. Servers can accommodate different amounts and types of RAM, and motherboards can have specific memory module placement rules.

Server motherboards normally require memory chips to be installed in pairs for efficient use by CPU sockets. Pairing, along with other memory requirements, can differ from one motherboard to the next, so be sure to read the motherboard documentation.

Memory Timing

Schemes such as double pumping can transmit data on the rise and fall of a clocking, or timing, signal. This means your data transfer rate is effectively doubled. You can think of electronic memory being organized into rows and columns.

The trick is getting data into or out of memory addresses as quickly as possible. Factors influencing memory speed include

•   How long it takes to select a memory column

•   How long it takes to select a memory row

•   How long it takes to read data when a memory row is selected

ECC

Most server motherboards can accommodate error correcting code (ECC) memory. This type of memory chip has the added capability of detecting and fixing memory errors at the bit (0 or 1) level. It does this by using an extra bit of information (the parity bit) for each group of memory bits.

Although most non-ECC modules can detect memory errors, they don’t do anything about it. You’ll find this often in consumer-grade computing equipment as opposed to servers. Non-ECC memory is cheaper than ECC memory. Your motherboard documentation will specify what type of memory chip can be used and how to enable ECC. The following illustration shows how ECC can be enabled in the BIOS.

EXAM TIP   You might get an exam question related to memory chip types. If your server enables the use of both ECC and non-ECC memory and you plan to use both, make sure you pair ECC chips together and non-ECC chips together. If you don’t do this, memory error correction will be disabled.

DDR

Double data rate (DDR) memory increases data transfer rates to and from memory, compared to single data rate (SDR); it’s all based on timing. As any musician will tell you, timing is crucial, and the same is true in the world of computing. There are different DDR standards, or versions, and they are not compatible with one another. This means DDR3 chip sockets on a motherboard will accept only DDR3 memory chips.

DDR2 supersedes DDR1, DDR3 supersedes DDR2, and so on. So if your server motherboard supports DDR2 through DDR4 RAM chips, you should choose DDR4 for the best performance. DDR3 memory is shown in Figure 2-7. The column access strobe (CAS) latency defines how long it takes for requested memory contents to leave the actual memory chip on their way to the bus. Table 2-3 shows DDR memory details.

Figure 2-7  DDR3 240-pin memory module

Table 2-3  DDR Memory Details

Buses

Motherboards and expansion cards need a way to move data around, and this is where the bus comes in. Think of computer buses like you think of real buses, which move people around using roads; a computer moves data bits around the system using buses.

There are many different types of buses, and some motherboards accommodate multiple buses. The buses we discuss here are for expansion cards plugged into expansion slots and include the PCI, PCI-X, and PCIe standards (discussed in the following sections). Using additional buses not supported by the motherboard is possible by using host bus adapter (HBA) cards, such as those used for storage area network (SAN) connectivity. Slimmer server form factors (such as rack-mounted servers) benefit from riser circuit boards that plug into the motherboard and enable expansion cards that otherwise wouldn’t fit to be plugged in.

PCI

Peripheral Component Interconnect (PCI) is a 32- and 64-bit bus and expansion slot card standard, but you won’t find it on many of today’s server motherboards. Back in the 1990s, PCI was a big deal, since it really was plug-and-play (PnP). This meant you didn’t have to fiddle around with jumpers and DIP switches to configure the card. As long as the BIOS and operating system supported PnP, all was good.

Interestingly, 64-bit PCI cards could be plugged into 32-bit PCI expansion slots and would still function, although at a slower rate. Another consideration was the card height, and this is an issue affecting more than just PCI cards. PCI full-height cards take more space than the related lower profile cards, and depending on the server case and motherboard form factors, a full-height card may not fit properly. PCI is rated between 133 and 800 MBps, depending on 32- or 64-bit and the frequency used.

PCI-X

PCI Extended supersedes PCI by improving transfer rates up to four times to and from slots with bit transfer rates between 2 and 4 GBps. This 64-bit parallel transmission standard runs at various frequencies (often the case with expansion slots and cards), which influences the data transmission speed.

PCIe

The serial transmission-based PCI Express standard supersedes both PCI and PCI-X, with more bandwidth, which is especially useful with video, storage, and network cards. The bandwidth will vary depending upon the specific version of PCIe and how many lanes (channels of communication) are used. Table 2-4 shows examples of PCIe speeds in megabytes per second (MBps) as well as gigabytes per second (GBps). (The number of PCIe lanes is denoted using an x symbol, so a single-channel configuration is listed as x1, a two-channel configuration is x2, and so on.)

Table 2-4  PCI Express Speed Examples

If your PCIe slots can accommodate x16, like the example shown in Figure 2-8, then of course you should opt for that type of card if you have the option, since it has the highest transmission rate. Direct memory access (DMA) is supported by some devices and enables access to system memory without involving the CPU.

Figure 2-8  A PCIe x16 motherboard slot

PCIe cards are not as tall as PCI cards, and most modern servers support PCIe cards. In some cases, the PCIe card may be hot-pluggable. The great thing about PCIe is that you can, for example, plug an x8 card into an x16 slot.

NICs

Most physical servers have at least two integrated network interface cards (NICs), but it’s pretty easy to find servers with four or more interfaces in some cases. Virtual servers can have as many virtual NICs (vNICs) as required for the server role. For instance, a virtual private network (VPN) server should have at least two interfaces.

If you’re adding NICs to a physical server, you need to know which type of unused expansion slots are in your motherboard (PCI, PCI-X, or PCIe). The network transmission speed is a big deal; your network infrastructure might support 10 Gbps, so you want to get the fastest NIC possible that will work in your environment.

Each NIC needs to be configured with the appropriate IPv4 or IPv6 settings (which will be discussed in detail in Chapter 5). Even though the NIC is specific to the server, you should consider what it is plugging into. For example, a multihomed server (which has more than one NIC) may have each NIC plugged into different network switches or a specific switch virtual LAN (VLAN) port. Then there’s NIC teaming—grouping NICs together for load balancing or better throughput; this applies both to physical and virtual machine NICs. Virtual machine NICs can be tied to specific underlying physical NICs.

Storage

Storage is sometimes embedded on a server motherboard, such as with some blade servers. Other times, servers have local disks available, and yet another possibility is a server reaching out over a network to use disk space. Storage attached to a local server is known as direct-attached storage (DAS), whereas network storage can come in the form of network-attached storage (NAS) or storage area networks (SANs). Chapter 4 covers storage in greater detail.

Virtual machines running server operating systems have a variety of options, including these:

•   Using a physical disk partition available from the underlying hypervisor

•   Using storage accessible over a SAN through the underlying hypervisor

•   Using a virtual hard disk (VHD) file

VHD files may be stored on a local disk on the underlying physical server or on a network storage location. For physical servers, you may also have to add an expansion card that connects the server to additional storage.

RAID Controllers

RAID groups physical disks together as a logical unit to increase disk performance and/or to provide disk-level fault tolerance. You can set this up at the software level (within the server OS) or at the hardware level using a RAID controller. RAID levels will be discussed in Chapter 4.

Most server motherboards include an integrated RAID controller that connects to multiple physical disks. RAID controllers have their own firmware configuration utility to set up the specifics. Disk arrays normally have hot spares, disk drives plugged in and ready to take over if disks currently active in the array fail. Now if this happens, you need to remove the failed disk itself and replace it with a functional one—this is called hot-swapping.

Battery-backed write caching is used for disk array controllers for a number of reasons. On occasion, you may find yourself reconfiguring or migrating disk stripe settings and data, and this feature proves useful; however, a common use is when stopping and restarting a disk array. Upon restart, data not yet written is cached (so it is not lost during a power cycle), so it gets written to disk.

Consider these items when working with hardware RAID:

•   Don’t worry about whether your server OS supports hardware RAID; this is a nonissue. The hardware will present what appears to be a single disk to the server OS.

•   Ensure that you have access to two or more disks either locally or over a storage network. This could involve asking your storage administrator to “carve out” a LUN (a number identifying a chunk of disk space) for you.

•   Decide which level of RAID makes sense for your situation. Are you concerned with fault tolerance, improved performance through disk striping, or both? Check out Chapter 4 for details on RAID levels.

•   Keep performing server backups! Some RAID levels duplicate data, but this doesn’t mean you shouldn’t continue server backup procedures.

USB

The fastest transmission technologies are serial, not parallel, and that includes universal serial bus, or USB. USB creators weren’t kidding when they selected the word “universal”—you can plug just about anything into a USB port:

•   Keyboard

•   Storage device (see Figure 2-9)

Figure 2-9  An external USB solid-state drive

•   Smartphone

•   Tablet

•   USB hub

•   Coffee mug warmer

•   Lamp

•   Cute mechanical puppy

Servers commonly use USB for keyboards and mice, which are referred to as human interface devices (HIDs). Storage is usually connected to a RAID controller. A few USB versions have evolved over the years, from USB 1.x all the way up to 4.x. You’ll find these details in Table 2-5.

Table 2-5  USB Standards and Transfer Rates

NOTE   Server rooms and data centers use KVM switches, which link numerous servers to a single keyboard, display, and mouse. These connections are made using a USB or IP addresses on a network. KVM switches using USB must be placed closer to the connected equipment than KVM switches connecting servers via IP addresses, which are potentially accessible from anywhere.

USB 3.0 is backward-compatible, so you can plug a USB 3.0 device into a non-USB 3.0 port. USB hubs enable you to plug in more devices than your machine could otherwise accommodate, but watch out for the power draw for USB devices that don’t have their own external power source. Also watch out for the appropriate use of USB cables—for example, one cable may be used only to charge a smartphone, while a similar-looking cable may be used for both charging and data transfer.

Power

From the smallest server in the enthusiast’s basement to thousands of servers in a data center, power is essential. Server virtualization reduces power consumption by consolidating multiple physical servers into virtual machines, but virtual machines must run on physical server hardware, and it needs to be powered.

Power connections (plugs and sockets) come in a variety of standards. The standard two-prong (or three-prong with ground) plug used in North America, the NEMA connector (National Electronic Manufacturers Association), is shown in Figure 2-10. Edison plugs are more rounded than NEMA plugs, but like NEMA, Edisons have three prongs. Industrial-grade equipment uses a twist-lock mechanism to prevent accidental disconnection from the socket.

Figure 2-10  NEMA three-prong socket and plug

Voltage

When two points in a circuit have differing potential electrical charges, they are said to differ in voltage. This difference encourages the flow of electrons, so, with a higher voltage (difference in charge), we have a stronger flow of electrons being forced through a circuit. This is a good thing when we want to power electrical components in a controlled manner, but it’s bad when we (humans) come into contact with components.

Different parts of the world provide electricity at different voltages using alternating current (AC) as opposed to direct current (DC), which is provided by batteries. In North America, the standard is 110 to 120 volts (V), but in Jamaica and most of Europe, 220 to 240V is the norm. Some equipment (notably telecommunications) reduces voltage (–48VV) for the proper functioning of integrated circuits (ICs).

CPUs don’t need as much power as the amount often fed from power supplies in the form of +5 or +12V, so the voltage regulator module (VRM) ensures that the CPU gets only the voltage it needs. This is normally built into the server motherboard.

Industrial environments using specialized equipment such as robotic machinery, motors, hydraulics, and the like will have different power requirements, such as 208, 440, 460, or even 480V. Transformers are used to supply the correct voltage. Most power companies around the world deliver 1-phase and 3-phase power. One-phase (1-phase) power is designed for moderate power requirements, and it’s what you’ll find being used in most households. Industrial environments use 3-phase power.

Electrostatic Discharge

In a perfect world, our bodies (and clothing, jewelry, and so on) would have the exact same charge as the electrical components that we touch, which would prevent the flow of electrons. In reality, the stronger flow of electrons is of concern for personal safety and to prevent damage to equipment, but the good news is there are preventative measures we can take! Electrostatic discharge (ESD) can be controlled in a number of ways:

•   ESD strap (bracelet)  Connect the alligator clip to the computer chassis.

•   ESD mat  Stand on this while servicing hardware.

•   ESD footwear  Seriously, this exists—the footwear contains resistors.

•   Touch the computer chassis  Do this as often as possible to dissipate any built-up static charge.

NOTE   About touching the computer chassis: Ideally you will be touching an unpainted part of the case. Should the machine be plugged into a wall outlet when servicing internal components? Yes and no, depending on who you ask. For a proper earth ground to a grounded power outlet, yes, leave the machine plugged in to dissipate built-up static charges to a larger object such as the ground. Ideally the power supply unit (PSU) itself will have an on/off switch; flip this to the off position. However, one could argue that it’s best to play it safe and the computer should be unplugged from a power outlet, even though the possibility of getting shocked is minimal. When electronic equipment is plugged in and you are poking around inside it, the chances of accidental shock increase. For the utmost in safety, unplug the computer and make sure you have a proper ESD mechanism in place.

The ideal way to minimize ESD would be to ensure that everything is at the voltage as earth ground. What’s more important is that you, the chassis, and the components are at the same electrical potential in terms of voltage.

Our bodies and clothing can build up a static charge, especially in a low-humidity environment. (We’ll talk about environment controls later in this chapter.) Sensitive electronic components, when not in use, should be stored entirely in ESD bags (those shiny, metal-looking bags). So when we are working with electronic components, including customer replaceable units (CRUs) provided under warranty by a vendor, you must take care. Certified technicians, such as those from a reputable vendor, will follow proper procedures such as wearing an ESD wrist strap connected to an unpainted part of a computer chassis or some other method of grounding when working with field replaceable units (FRUs).

CAUTION   You can destroy sensitive components without even knowing it. Your body builds up a static charge naturally as you move about, and as little as 5V could fry a component. Always take precautions to minimize ESD.

Wattage

Server components draw power from the power supply unit (PSU), and most server-class hardware uses redundant PSUs in case one fails. It’s important that you calculate the sum of power required for all internal components and to make sure the PSU form factor matches the server chassis form factor.

The more CPUs and RAM in a system, the greater the power draw. The more disks you have connected to a RAID controller, the more power is drawn. Bear in mind that solid-state drives (SSDs) draw less power than traditional spinning hard disks. Most servers these days use network storage, so the power consumption in this case would apply to the storage enclosure itself and not the server.

PSUs have total wattage listings, such as 500W, 1400W, and so on. Some equipment will sometimes specify the power draw in volt-amperes (VA) instead of watts. When you’re planning server capacity, be sure to think about all components and their power requirements.

CAUTION   Never, ever open up a PSU unless you are a qualified technician. It’s not just the voltage that can harm humans, but the voltage and amperage, or the flow of current. For example, as little as 10 milliamps (thousandths of an ampere) at 110V alternating current (AC) can stop your heart.

Uninterruptible Power Supply

Uninterruptible power supply (UPS) batteries are constantly charged from the standard electricity power grid so that in the event of a power outage, servers plugged into the UPS can at least shut down gracefully. Devices should be plugged into UPSs for protection against power outages. Standby UPS systems quickly switch to battery power when the main power source (power grid) fails. Online UPS systems always use their batteries, which are constantly refreshed when the main power source is available, and they ensure a consistent regulated flow of electricity to devices; this means online UPS systems are more expensive than standby systems, but they are appropriate for minimizing disruptions to mission-critical IT services.

UPS devices are normally rack-mounted in server rooms or data centers, and you should make sure the floor can handle their weight. But how can you make sure the UPS batteries can supply enough power to devices? Kilowatts (kW), or thousands of watts, are usually used for UPS power ratings, although sometimes the rating is in volt-amperes (VA). You should total the draw for a UPS to ensure that there’s enough power to go around.

CAUTION   UPS devices are heavy! As with other heavy items, use proper lifting techniques to avoid injury: lift with your legs, not your back. Try not to turn at the waist while carrying a UPS; instead, turn your entire body.

The UPS runtime capacity specifies how long UPS batteries can support a specific wattage load when the power goes out. For example, a UPS with a certain number of batteries might supply 900W of power for 9 minutes, whereas with a draw of only 300W, it might supply power for 50 minutes. You can also acquire UPS systems designed for entire data center or industrial use.

Calculating UPS Power Draw

Calculating the power drawn by IT equipment in server rooms and data centers is important in ensuring adequate power, including backup power provided by UPS systems. Consider the amount of power needed for an entire rack of equipment or multiple racks such as in a data center. To do this you will need to consider the following:

•   Number of servers in the rack

•   Power draw per server

•   Power draw per storage array (storage controllers in the enterprise often take the form of a rack-mounted server)

•   How busy each server is (a server running on average at only 30 percent capacity draws less power than one running at 90 percent)

Next, perform the calculation:

1.   Determine the standard power draw for a device by referring to the product documentation or tags on PSUs, which may express this in amps and volts, or watts. In the case of amps and volts, multiply the amps by the volts for each device. In the case of watts, divide this value by the power factor ratio for the server, which is commonly 0.9. So 2700W equals 3000VA. Volt-amps (VA) is a common unit of measurement often expressed when discussing a UPS system. One kilovolt-amp (kVA) is 1000 volt-amps.

2.   Add up the kVA values for all equipment to be serviced by the UPS and multiply this by a factor slightly larger than 1 (such as 1.3) to account for future growth and power draw fluctuations based on running workloads.

3.   Ensure the watt or VA for the UPS system is a larger value than your calculated power draw, such as the draw for a single rack of equipment.

UPS Monitoring and Management

Conduct UPS battery testing periodically to ensure that the batteries will provide power when needed. Many UPS devices have built-in options where you can schedule the battery test interval on a recurrent basis. There are also battery testers you can use that work even when the batteries are in use, but some of these can be expensive. When maintenance of the UPS or its batteries is required, you can use bypass devices to ensure that the UPS power load is not interrupted.

TIP   Don’t plug nonessential devices into the UPS. For example, laser printers draw a lot of power and really don’t need power to shut down gracefully if the power goes out. Similarly, it may not make sense to plug a router into the UPS if network switches are not also plugged into it.

As a Server+ technician, once servers are up and running, you may not find yourself physically near them for day-to-day management, and this also includes UPS devices. Here are a few UPS remote management considerations:

•   The UPS can be connected to the server via a USB cable.

•   The UPS can be plugged into the network.

•   Remote monitoring and management is possible using protocols such as Simple Network Management Protocol (SNMP).

•   Most vendors offer a mobile device app for UPS monitoring.

Environmental Controls

Too much heat is bad for electrical equipment and shortens its life, and not enough humidity increases the likelihood of ESD. HVAC (heating, ventilation, air conditioning) is a big deal for server rooms and data centers.

Temperature

Some CPUs will throttle their throughput if the temperature gets too high. Some have pointy thermal dissipation (heat sinks) on the chip; more surface area helps to dissipate heat quickly. If the CPU gets too hot, it will run much slower than it normally does (faster CPU speeds means more heat), and it’s not just CPUs you should be concerned with—it’s all electronic equipment. Generally speaking, server rooms and data centers should fall somewhere in the range of 65° to 80° Fahrenheit (18 to 27° C).

Sensors can detect temperature and humidity levels to control room temperature and humidity, but internal server temperature is more directly controlled with fans or liquid cooling systems, in which pipes carry cool liquid throughout the system to cool the surrounding air. Computer case fans are designed to take in cooler room air to pass over internal components and then expel the warmed air out to the room.

NOTE   British thermal units (BTUs) are a standard way to measure the heat output of computing equipment. You can use this value to calculate HVAC (heating, ventilation, and air conditioning) requirements to accommodate the heat generated by equipment.

Airflow

Larger server rooms and data centers have racks of heat-generating equipment. Cool air needs to be fed into the rooms for cooling, and the expelled warmer air needs to be kept separate—but how?

Hot and Cold Air Separation

Separating hot and cold air is achieved using hot and cold aisles. Racks of equipment are arranged in rows, or aisles, for optimal airflow. Baffles are used to control the flow of cooler air into rack-mounted equipment intake fans and to keep the resulting warmer air separate. So, stated simply, cool air should be channeled using baffles and fed to the front of equipment (assuming intake fans are on the front), and baffles or shrouds should channel the resulting warm air from the back away from the cooler air.

Server room racks may not be fully populated with devices, and remember that vented rack blanking panels can be used to control airflow. The added benefit of properly designed airflow systems is that they are less wasteful of energy and thus save money.

Humidity

Controlling the amount of moisture in the air is crucial for the proper functioning of equipment and to prevent ESD. Too little humidity increases the likelihood of ESD; too much humidity results in water condensation on equipment.

Temperature and humidity sensors are a must in server rooms and data centers. More sophisticated HVAC systems will provide a way to configure threshold and alert notifications when values are unacceptable, or they can automatically make adjustments. As a rule of thumb, relative humidity levels should fall somewhere within 40 to 60 percent. The longer temperature and humidity levels are out of range, the more likely equipment will fail.

Fire Suppression

The problem with baffles and shrouds being used to funnel airflow is that they are bulky. In the event of a server room or data center fire, this can impede fire extinction. Of course, the safe evacuation of personnel always takes priority over replaceable equipment. Periodic fire drills are a must!

Smoke detectors can alert technicians to impending fire issues, but the detectors used in data centers are much more sensitive than those you would use in your home. Clean-agent fire suppression systems remove heat to extinguish fires, whereas inert-gas solutions remove oxygen from the fire. Halon systems were used in the past but are no longer the norm because of their negative environmental effects.

Water sprinkler systems should be avoided, unless they are a secondary system when primary fire suppression systems fail. Water will certainly damage electronic equipment, and it can increase the possibility of electrocution (water conducts electricity). As if that isn’t scary enough, pooling and running water can spread fires throughout a facility. There are variations of water “misting” solutions that can help with these problems.

Fire suppression systems, including fire extinguishers (Figure 2-11), can help minimize equipment damage, including smoke damage, but no system is perfect.

Figure 2-11  A Class C fire extinguisher is capable of putting out electrical fires.

Table 2-6 lists common fire extinguisher classes and when they should be used. As with any crucial system, periodic testing, monitoring, and drills can make all the difference when a fire incident actually occurs.

Table 2-6  Classes of Fire Extinguishers

Hands-on Exercises

Exercise 2-1: Calculate Rack Space

A server room rack measures 42U. Currently the rack contains

•   Three rows of 7U UPS batteries

•   A 10U blade enclosure

How many additional 7U UPS batteries can be mounted in the rack?

The Answer

Since the server room rack totals 42U and 31U are currently used, that leaves us with 11U (42–31). Therefore, only one row of 7U UPS batteries can be mounted in the rack.

Exercise 2-2: Create a Microsoft Windows Server 2019 Virtual Machine Configuration

Make sure the lab setup instructions in Appendix A have been completed before attempting this exercise. This exercise does not actually install the Windows Server operating system; it just gets the virtual hardware configured for use in a later exercise.

1.   From the Windows Start menu, choose VMware Workstation Pro. In VMware Workstation, choose File | New Virtual Machine.

2.   Choose Typical (Recommended) and click Next.

3.   Choose I Will Install The Operating System Later, and then click Next.

4.   From the Guest Operating System list, ensure that Microsoft Windows is selected, and from the Version drop-down list, ensure that Windows Server 2019 is selected. Click Next.

5.   Name the virtual machine Srv2019-1 and specify a location that has sufficient free hard disk space. Click Next.

Note that this name applies only to VMware. The name configured within the operating system can be something completely different, although in further exercises it will be set to the same value.

6.   On the Specify Disk Capacity wizard page, accept the defaults and click Next. Then, on the final wizard page, click Finish.

7.   We want our server to have four hard disks in total so that we can configure software RAID later. In VMware Workstation, click Edit Virtual Machine Settings on the left side of the screen. Notice the existing single virtual hard disk of 60GB.

8.   Click the Add button at the bottom left of the window, select Hard Disk, and click Next.

9.   Select NVMe (Recommended) and click Next. Choose Create A New Virtual Disk and click Next.

10.   Notice that the default size is 60GB. Leave this unchanged and click Next.

11.   On the Specify Disk File page, accept the default filename and click Finish. Notice the New Hard Disk (NVMe) 60GB listing.

12.   Repeat steps 8 through 11 two more times to add more disk space. Your virtual machine settings will then list four virtual hard disks, as shown in the following illustration. Click OK.

Exercise 2-3: Create an Ubuntu Linux Server 20.04.1 Virtual Machine Configuration

Make sure the lab setup instructions in Appendix A have been completed before attempting this exercise. This exercise does not actually install the Linux operating system; it just gets the virtual hardware configured for use in a later exercise.

1.   If it’s not already running, start VMware Workstation Pro from the Windows Start menu. Choose File | New Virtual Machine.

2.   Choose Typical (Recommended) and click Next.

3.   Choose I Will Install The Operating System Later, and then click Next.

4.   From the Guest Operating System list, ensure that Linux is selected, and from the Version drop-down list, ensure that Ubuntu 64-bit is selected. Click Next.

5.   Name the virtual machine Ubuntu-1 and specify a location that has sufficient free hard disk space. Click Next.

Note that this name applies only to VMware. The name configured within the operating system can be something completely different, although in further exercises it will be set to the same value.

6.   On the Specify Disk Capacity wizard page, accept the defaults and click Next. On the final wizard page, click Finish.

7.   We want our server to have three hard disks in total so that we can configure software RAID later. In VMware Workstation, click Edit Virtual Machine Settings on the left side of the screen. Notice the existing single Hard Disk (SCSI) 20GB listing.

8.   Click the Add button in the bottom left of the window, select Hard Disk, and click Next.

9.   Select SCSI (Recommended) and click Next. Choose Create A New Virtual Disk, and click Next.

10.   Change the size to 10GB and click Next.

11.   On the Specify Disk File page, accept the default filename and click Finish. Notice the new 10GB hard disk is now listed.

12.   Repeat steps 8 through 11 one more time to add more disk space. Your virtual machine settings will then list three virtual hard disks, as shown in the following illustration. Click OK.

Chapter Review

In this chapter, you learned that servers consist of various hardware components that must be carefully selected to meet functionality needs. This is true of both physical and virtual server computing environments.

Server Form Factors

The most common form factors are tower, rack-mounted, and blade servers. Blade servers take the least amount of space because they are essentially circuit boards. Racks and rack-mounted equipment are measured in Us, where 1U is 1 3/4 inches in height. Server components such as disks and PSUs, as well as rack components such as PDUs, are often duplicated to eliminate single points of hardware failure.

Server Components

Server motherboards use either the older BIOS or the newer UEFI firmware standard. UEFI supports enhanced features such as IPv6 boot support and Secure Boot. Modern motherboards have many components built-in or integrated, such as NICs, RAID controllers, and video. CPUs are mostly 64-bit. SMP server motherboards have multiple CPU sockets, and each CPU chip can contain multiple cores, which speeds up processing.

Buses move data around in a computer system. The FSB quickly moves data between system RAM and the CPU. Other motherboard chipsets control data flow to slower components such as expansion card slots and USB devices. CPU processing can be sped up using L1 to L3 caches, where L1 is the fastest (and most expensive).

Servers often use ECC memory modules, which use an extra parity bit to detect and correct memory corruption problems. ECC chips should be paired together in the correct motherboard slots. DDR4 modules transfer data more quickly than DDR2. Motherboard documentation will detail support for types of memory and denominations.

The most common type of expansion card slots on motherboards are

•   PCI (older standard)

•   PCI-X

•   PCIe

Peripheral Component Interconnect (PCI) is an older standard, and most newer motherboards do not have standard PCI slots. PCI Extended (PCI-X) and PCI Express (PCIe) are newer card types; modern motherboards tend to have PCIe slots rather than PCI. PCIe uses lanes to transmit and receive data. An x16 PCIe card transfers data much more quickly than an x4 or x8 PCIe card. Servers, either directly (tower) or indirectly (blade via backplane or midplane), often use PCIe NICs. Blade systems could require a backplane/midplane upgrade before supporting faster network speeds through expansion cards.

Server storage can come in the form of DAS, NAS, or SAN. RAID is used to group physical disks together to improve disk I/O performance (striping) or for disk fault tolerance. Server hardware normally supports RAID integrated on the motherboard; otherwise, software RAID within the operating system can be used.

Servers can use USB for input devices such as keyboards. USB standards and speeds are as follows:

•   USB 1: 12 Mbps

•   USB 2: 480 Mbps

•   USB 3: 5 Gbps

•   USB 4: 40 Gbps

Power

The main types of power connectors are NEMA, Edison, and twist-lock. Wattage refers to a unit of power. Voltage refers to the potential electrical charge difference between two points in a circuit. Kilowatts (kW) and volt-amperes (VA) are units of measurement used with UPS power ratings. To prevent ESD, which can ruin electronics, ESD straps or mats should be used.

Environmental Controls

Properly designed HVAC systems provide the correct temperature and humidity for the optimal operations of electronic equipment. Airflow in server rooms and data centers is crucial to keep incoming cool air separated from outgoing warmer air. Hot and cold aisles, baffles, and shrouds are used to control airflow.

Water should not be used as the primary fire suppressant when electronics are involved. Modern solutions aim to remove heat or oxygen from the fire.

Questions

1.   Data center equipment racks are normally how wide?

A.   16 inches

B.   19 inches

C.   24 inches

D.   32 inches

2.   Which unit of measurement is used for racks and rack-mounted devices?

A.   W

B.   Inches

C.   Centimeters

D.   U measure

3.   Which term describes the chassis housing multiple blade servers?

A.   Blade house

B.   Blade enclosure

C.   Blade box

D.   Blade baffle

4.   Which firmware standard supports the Secure Boot feature?

A.   UEFI

B.   CMOS

C.   BIOS

D.   PCIe

5.   Larry, a server technician, is attempting to start the Linux operating system on a blade server but keeps getting “Access Denied” messages. What should Larry do?

A.   Reinstall Linux.

B.   Update the motherboard firmware.

C.   Disable UEFI Secure Boot.

D.   Enable UEFI Secure Boot.

6.   You are ordering server hardware that will run mathematically intensive engineering applications. Which server component can help the most in speeding up processing time?

A.   RAM

B.   Greater disk storage capacity

C.   L1 cache

D.   L4 cache

7.   A newly installed tower server will function as a packet-filtering firewall. Currently, the server has three NICs, each connected to separate VLANs. A fourth NIC is required for connectivity to a perimeter network. When choosing a new NIC, what factor should be considered?

A.   PCIe versus PCI

B.   RAID 0 versus RAID 1

C.   IPv4 versus IPv6

D.   BIOS versus UEFI

8.   Which USB standard supports transmission rates up to 480 Mbps?

A.   USB 1

B.   USB 2

C.   USB 3

D.   USB 4

9.   Which term identifies the flow of electrons between two differently charged endpoints in a circuit?

A.   Volts

B.   Watts

C.   PSD

D.   ESD

10.   You are planning to upgrade your existing UPS system. How can you ensure device power needs will be met?

A.   Determine UPS kW or VA rating, calculate power draw sum of devices.

B.   Determine UPS V or W rating, calculate power draw sum of devices.

C.   Determine UPS kW or VA rating, calculate power draw average of devices.

D.   Determine UPS V or W rating, calculate power draw average of devices.

11.   Which two items are critical when planning server room racks? Choose two.

A.   Length of network cables

B.   Total amount of CPU computing power

C.   Rack weight

D.   Airflow

12.   A line-of-business database application is regularly accessed by many users concurrently. After monitoring server performance metrics, you conclude that disk I/O is the bottleneck. What can you do to optimize application performance?

A.   Configure RAID disk striping.

B.   Configure BIOS disk striping.

C.   Configure RAID disk fault tolerance.

D.   Configure BIOS disk fault tolerance.

13.   What can be used to prevent server interruptions when disks fail?

A.   Hot-swappable disks

B.   RAID fault tolerance

C.   RAID disk striping

D.   UEFI

14.   In which type of environment is 1-phase power most often used?

A.   Industrial

B.   Data center

C.   Manufacturing

D.   Residential

15.   What purpose does a UPS serve?

A.   Enables servers to perform graceful shutdowns

B.   Keeps servers running when the power goes out

C.   Increases wattage for components requiring it

D.   Protects server from malicious attacks

16.   Which items are affected by server form factors? Choose two.

A.   Type of expansion card

B.   Amount of supported RAM

C.   Rack mount ability

D.   Disk space capacity

17.   Which server rack item prevents cables from pulling out when you slide out a server for servicing?

A.   Rack cable arm

B.   Cable management arm

C.   Rack cable extender

D.   Cable management extender

18.   Which statement regarding blade servers is true?

A.   The server is a standalone piece of equipment.

B.   The server is mounted into rails on a server rack.

C.   The server has its own power supply.

D.   The server slides into an enclosure.

19.   How is data transmitted throughout a computer system?

A.   PCI

B.   Bus

C.   PCIe

D.   CMOS

20.   You want to ensure that your RAID controller caches disk writes. Which option must the controller support?

A.   Write-back caching

B.   Read-write caching

C.   Restart-enabled write caching

D.   Battery-backed write caching

21.   What is a KVM switch used for?

A.   Network device interconnect

B.   Server management

C.   Redundancy

D.   RAID controllers

22.   Why are server racks arranged in rows?

A.   To optimize airflow

B.   To allow access to servicing panels

C.   To reduce the impact of fire

D.   To increase security

23.   Which class of fire extinguisher is used to extinguish server equipment fires?

A.   A

B.   C

C.   D

D.   B

24.   You are the server technician for a Caribbean telecommunications provider. Power on the island is unreliable, and you want to prevent servers from abruptly shutting down. What should you acquire?

A.   ABS

B.   UPS

C.   RDP

D.   ESD

25.   One of your clients needs a new physical server to store files and run a small customer database application. The IT budget is very small, and the company wants to reuse any existing hardware components, such as network cards, that they have on hand. Which server form factor should you recommend to your client?

A.   Tower

B.   Rack-mounted

C.   Blade

D.   Virtual

Questions and Answers

1.   Data center equipment racks are normally how wide?

A.   16 inches

B.   19 inches

C.   24 inches

D.   32 inches

B. Most rack systems are 19 inches wide, although they are available in wider formats such as 23 inches. A, C, and D are incorrect. These values are not used for rack widths.

2.   Which unit of measurement is used for racks and rack-mounted devices?

A.   W

B.   Inches

C.   Centimeters

D.   U measure

D. A U equals 1 3/4 inches. This is used to measure racks and the devices that fit into them. A, B, and C are incorrect. These units of measurement are not used in rack-mounted systems.

3.   Which term describes the chassis housing multiple blade servers?

A.   Blade house

B.   Blade enclosure

C.   Blade box

D.   Blade baffle

B. A blade enclosure contains multiple blade servers. A, C, and D are incorrect. These blade terms are fictitious.

4.   Which firmware standard supports the Secure Boot feature?

A.   UEFI

B.   CMOS

C.   BIOS

D.   PCIe

A. UEFI supersedes the older BIOS standard and supports the Secure Boot feature, which ensures that only trusted (digitally signed) operating systems are allowed to start. B, C, and D are incorrect. CMOS refers to your specific configuration of hardware settings supported by the BIOS. The PCIe expansion card standard supersedes both PCI and PCI-X, with more bandwidth.

5.   Larry, a server technician, is attempting to start the Linux operating system on a blade server but keeps getting “Access Denied” messages. What should Larry do?

A.   Reinstall Linux.

B.   Update the motherboard firmware.

C.   Disable UEFI Secure Boot.

D.   Enable UEFI Secure Boot.

C. Some operating systems cannot be used with the UEFI Secure Boot feature because they are not digitally signed. This lack of a trusted signature can result in error messages when the system boots if the Secure Boot feature is enabled, so one solution is to disable UEFI Secure Boot. A, B, and D are incorrect. Reinstalling Linux, updating motherboard firmware, and enabling UEFI Secure Boot will not solve the problem. Linux is already installed (it had to have worked somehow at some point for the installation to complete); the solution is to disable UEFI Secure Boot.

6.   You are ordering server hardware that will run mathematically intensive engineering applications. Which server component can help the most in speeding up processing time?

A.   RAM

B.   Greater disk storage capacity

C.   L1 cache

D.   L4 cache

C. L1 cache is high-speed memory that is used by the CPU to fetch instructions and/or data quickly that has already been accessed. A, B, and D are incorrect. Adding RAM enables more programs and services to run simultaneously, but it doesn’t help with the requirements in this scenario. More disk space will not speed up programs that are mathematically intensive, and L4 cache is not accessed as quickly by the CPU as L1 cache is.

7.   A newly installed tower server will function as a packet-filtering firewall. Currently, the server has three NICs, each connected to separate VLANs. A fourth NIC is required for connectivity to a perimeter network. When choosing a new NIC, what factor should be considered?

A.   PCIe versus PCI

B.   RAID 0 versus RAID 1

C.   IPv4 versus IPv6

D.   BIOS versus UEFI

A. Tower server motherboards will most likely accommodate PCIe cards, but older ones might support PCI. B, C, and D are incorrect. RAID is related to multidisk configuration and not networking. IPv4 and IPv6 are software protocols that are not directly impacted when choosing a server NIC. Whether the older BIOS or newer UEFI firmware standard is used has no impact on the NIC selection, as long as the selected NIC can be accommodated by the motherboard slots.

8.   Which USB standard supports transmission rates up to 480 Mbps?

A.   USB 1

B.   USB 2

C.   USB 3

D.   USB 4

B. In theory, the USB 2 standard can transfer data at approximately 480 Mbps. A, C, and D are incorrect. The USB 1 maximum speed is 12 Mbps, USB 3 is 5 Gbps, and USB 4 maximum speed is 40 GGbps.

9.   Which term identifies the flow of electrons between two differently charged endpoints in a circuit?

A.   Volts

B.   Watts

C.   PSD

D.   ESD

D. ESD, or electrostatic discharge, is the transfer of electrons between two differently charged points in a circuit. ESD can damage sensitive electronic components, so precautions such as ESD wrist straps or ESD mats should be used. A, B, and C are incorrect. Volts are a unit of measurement related to expressing the difference in electrical potential. Watts are used to measure units of power. PSD is not a valid acronym in this context.

10.   You are planning to upgrade your existing UPS system. How can you ensure device power needs will be met?

A.   Determine UPS kW or VA rating, calculate power draw sum of devices.

B.   Determine UPS V or W rating, calculate power draw sum of devices.

C.   Determine UPS kW or VA rating, calculate power draw average of devices.

D.   Determine UPS V or W rating, calculate power draw average of devices.

A. Most UPSs express their power ratings in either kilowatts (kW) or volt-amperes (VA). The power draw for all devices that will be plugged into the UPS system should be totaled to ensure that enough power will be supplied in the event of a power failure. B, C, and D are incorrect. Volts and watts are not used to rate power supplied from a UPS system. When determining whether the UPS can support devices, the total power draw of those devices must be compared to the UPS rating.

11.   Which two items are critical when planning server room racks? Choose two.

A.   Length of network cables

B.   Total amount of CPU computing power

C.   Rack weight

D.   Airflow

C, D. A full rack can weigh hundreds of pounds; floors must be able to support these loads properly. Airflow can be controlled around racks using baffles, shrouds, and vented filler panels. A and B are incorrect. Although recommended network cable lengths should not be exceeded, this is not as important as rack weight and airflow. CPU computing power is a server planning consideration, not a rack planning consideration.

12.   A line-of-business database application is regularly accessed by many users concurrently. After monitoring server performance metrics, you conclude that disk I/O is the bottleneck. What can you do to optimize application performance?

A.   Configure RAID disk striping.

B.   Configure BIOS disk striping.

C.   Configure RAID disk fault tolerance.

D.   Configure BIOS disk fault tolerance.

A. RAID disk striping arranges multiple disks to work as a single unit to optimize disk reads and writes. B, C, and D are incorrect. There is no such thing as BIOS disk striping. Disk fault tolerance will not improve application performance.

13.   What can be used to prevent server interruptions when disks fail?

A.   Hot-swappable disks

B.   RAID fault tolerance

C.   RAID disk striping

D.   UEFI

A. Hot-swapping enables the exchanging of hardware components while the server is running. B, C, and D are incorrect. Even though there are types of RAID configurations that can ensure that things keep running when disks fail, it depends on the implementation; hot-swapping is a better answer. UEFI is a firmware standard that replaces the BIOS standard; it is not related to disk failures.

14.   In which type of environment is 1-phase power most often used?

A.   Industrial

B.   Data center

C.   Manufacturing

D.   Residential

D. One-phase power is used for small power draw needs such as heating systems and lighting. A, B, and C are incorrect. Industrial and manufacturing environments, along with data centers, often use 3-phase power because of the larger power draw.

15.   What purpose does a UPS serve?

A.   Enables servers to perform graceful shutdowns

B.   Keeps servers running when the power goes out

C.   Increases wattage for components requiring it

D.   Protects server from malicious attacks

A. UPS systems enables servers to shut down properly instead of abruptly, which can corrupt open files. B, C, and D are incorrect. UPS systems are not designed to keep servers running other than for very short periods, nor do they increase wattage or protect from attacks.

16.   Which items are affected by server form factors? Choose two.

A.   Type of expansion card

B.   Amount of supported RAM

C.   Rack mount ability

D.   Disk space capacity

A, C. Expansion cards, such as PCI, may not fit into slimmer server profiles such as rack-mounted servers. Tower servers cannot be rack-mounted, so rack mount ability is another item affected by server form factors. B and D are incorrect. The amount of RAM or disk space is not affected by server form factors.

17.   Which server rack item prevents cables from pulling out when you slide out a server for servicing?

A.   Rack cable arm

B.   Cable management arm

C.   Rack cable extender

D.   Cable management extender

B. Cable management arms contain server cables and fold out when the server is slid out on rails. A, C, and D are incorrect. Rack cable arm, rack cable extender, and cable management extender are not proper terms.

18.   Which statement regarding blade servers is true?

A.   The server is a standalone piece of equipment.

B.   The server is mounted into rails on a server rack.

C.   The server has its own power supply.

D.   The server slides into an enclosure.

D. A blade enclosure can contain many blade servers that slide in to make a connection to the midplane. A, B, and C are incorrect. Blade servers cannot run on their own; they must be placed in a blade enclosure. Blades themselves are not rack-mounted, although blade enclosures are. Blades do not have on-board power sources; this comes from the enclosure.

19.   How is data transmitted throughout a computer system?

A.   PCI

B.   Bus

C.   PCIe

D.   CMOS

B. Computers contain multiple buses that transmit data throughout the system. A, C, and D are incorrect. PCI and PCIe are expansion card standards that have their own buses for moving data into and out of card slots. CMOS refers to your specific configuration of hardware settings supported by the BIOS.

20.   You want to ensure that your RAID controller caches disk writes. Which option must the controller support?

A.   Write-back caching

B.   Read-write caching

C.   Restart-enabled write caching

D.   Battery-backed write caching

D. Battery-backed caching uses a battery to supply power to cached data writes. A, B, and C are incorrect. Write-back caching, read-write caching, and restart-enabled write caching are incorrect terms in this context.

21.   What is a KVM switch used for?

A.   Network device interconnect

B.   Server management

C.   Redundancy

D.   RAID controllers

B. KVM switches have a keyboard, video display, and mouse attached along with cables plugged into numerous servers; the servers can be managed locally without each needing a keyboard, video, and mouse. A, C, and D are incorrect. KVM switches do not interconnect network devices, and they do not provide redundancy or RAID controller features.

22.   Why are server racks arranged in rows?

A.   To optimize airflow

B.   To allow access to servicing panels

C.   To reduce the impact of fire

D.   To increase security

A. Rows of racks enable cool air to be taken into devices and warm air to be exhausted out the back; these are called hot and cold aisles. B, C, and D are incorrect. Rack rows do not facilitate servicing, and they do not reduce fire impact or increase security.

23.   Which class of fire extinguisher is used to extinguish server equipment fires?

A.   A

B.   C

C.   D

D.   B

B. Class C fire extinguishers are designed to put out fires based on electrical components. A, C, and D are incorrect. Class A extinguishers are for paper, wood, or cloth fires. Class D fire extinguishers are for combustible metal fires, and class B fire extinguishers are for flammable liquid fires.

24.   You are the server technician for a Caribbean telecommunications provider. Power on the island is unreliable, and you want to prevent servers from abruptly shutting down. What should you acquire?

A.   ABS

B.   UPS

C.   RDP

D.   ESD

B. UPS systems enable servers to shut down properly instead of abruptly, which can corrupt open files. A, C, and D are incorrect. ABS is not a valid term in this context. RDP is the Remote Desktop Protocol used to manage a computer remotely over the network. ESD is electrostatic discharge, which occurs when two devices in close proximity have varying electrical charges.

25.   One of your clients needs a new physical server to store files and run a small customer database application. The IT budget is very small, and the company wants to reuse any existing hardware components, such as network cards, that they have on hand. Which server form factor should you recommend to your client?

A.   Tower

B.   Rack-mounted

C.   Blade

D.   Virtual

A. Tower servers are generally cheaper than blade or rack-mounted servers, and because they contain standard hardware, reusing components is not a problem. B, C, and D are incorrect. Rack-mounted and blade servers can be expensive and are not the best choices for a small shop. A virtual server is not an option because the question states a physical server is required.

CHAPTER 8

Disaster Recovery Planning

In this chapter, you will

•   Learn about disaster recovery

•   Identify threat impacts on business operations

•   Understand business continuity

•   Distinguish various replication types

•   Implement appropriate backup techniques

This chapter will help you proactively plan for negative incidents that can affect business operations. Threats have to be mapped to their potential impact to the organization, and server technicians must be aware of the procedures within the disaster recovery plan to return IT systems to a functional state.

Disaster Recovery

IT problems resulting from a disaster could be as small as a failed drive in a RAID 5 array or as large as an entire office or data center being unavailable. Your organization’s ability to bounce back quickly from catastrophic IT incidents results from proactive planning and requires technicians who know their roles.

The recovery time objective (RTO) is the maximum amount of time that can be tolerated for an IT service to be down before it has a negative impact on the business. As such, the RTO is an important component of a business impact analysis (BIA). Ensuring that all involved parties know their roles in the disaster recovery plan through simulated tabletop exercises can ensure that the RTO is met.

Alternate Sites

Alternate sites enable business operations to continue when a primary site experiences some kind of disruption. For example, suppose a data center experiences region-wide communications link failure. Customers that depend on IT services from the unreachable data center can be redirected to another, alternate, data center, where IT systems are running and customer data has already been replicated from the primary site. The back-end virtual machine servers hosting a cloud load-balanced application can be spread across regions to achieve this. A round robin load balancing configuration can distribute requests to servers in different regions as well.

Many things must be done before a site failure occurs:

•   An alternate location must be acquired or built.

•   High-speed communication links must be in place between the sites.

•   The IT infrastructure has to be in place at the alternate site.

•   Hardware

•   Hypervisors up and running

•   Dynamic Host Configuration Protocol (DHCP) and Domain Name Service (DNS)

•   Data replication between the two sites must be configured.

•   Varying solutions determine how often data replicates.

•   Communications link speeds determine how much data can be replicated within a given timeframe.

When an alternate site is active and a negative incident occurs, several things are set into motion, such as the following:

•   Failing over IT services to the alternate site

•   DHCP and DNS

•   Hosted web sites

•   Virtual machines

•   Line of business applications

•   Ensuring network address changes do not affect IT service consumers

•   Dynamic DNS updates for changed IPv4 and IPv6 addresses

•   Ensuring that notifications are sent to affected stakeholders

Individual network services can be made highly available using failover clustering solutions. Multiple servers (cluster nodes) use the same shared storage and have the software installed and configured identically, so that if one server fails, another one can take over. When a cluster node connects to shared storage, it normally uses a most recently used (MRU) path selection policy from that point onward; the server will attempt other paths to the shared storage if the current path fails.

Some specific services, such as DHCP, can be specifically configured for failover, as shown in Figure 8-1. Administrators configure clustered services as either active/active or active/passive. In an active/active configuration, the clustered service is actually running simultaneously on multiple cluster nodes, which can result in zero downtime (called a live failover). In an active/passive configuration, if the node where the service is running fails, the service fails over and starts up on another cluster node.

Figure 8-1  Configuring DHCP failover for high availability

The configuration can also determine that the failed over service is failed back to the original host once it is up and running once again. In rolling cluster updates, a staggered process of applying cluster node updates ensures that some cluster nodes always remain running.

Clustering solutions use a periodic heartbeat transmission from each cluster node to ensure that nodes have not failed. It’s best to use a dedicated network adapter for cluster heartbeats.

Hot Site

A hot site is an alternate location that can actively continue business operations at a moment’s notice when the primary site becomes unavailable. Communication links, network equipment and software, staff, as well as up-to-date data are ready to go so that business operations can continue well within the RTO.

Large organizations and government agencies control their own data centers, and hot sites are entirely under their own control. Smaller organizations and individual consumers indirectly partake in this through IT service provider disaster recovery (DR) sites.

DR sites are commonly used by public cloud providers. These organizations have large data centers located throughout the world that offer cloud IT services to companies and individuals in different regions. The data centers are designed to withstand natural and manmade disasters—for example, large generators can provide power if the power goes out.

Shared DR hot site facilities are used by multiple companies and are less expensive than a DR host site dedicated to a single company. Regulations or organizational security policy may prohibit IT system and data cohabitation with other organizations, however.

Hot sites stay up-to-date with continuous data protection (CDP) replication between sites, so that data is accessible from the hot site if the primary site becomes inaccessible.

EXAM TIP   Watch out for exam questions related to items available at an alternate site. A hot site is the most expensive type of alternate site to maintain, because it must contain equipment, software, staff, and up-to-date data resulting from replication from the primary site.

Cold Site

Unlike hot sites, cold sites do not have IT equipment, software, data, and staff already in place. Essentially, a cold site is a location with power and communications links in place. In the event of a disaster, equipment, software, data, and people need to be provided at the cold site.

One common problem with a cold site is software. Getting operating system (OS) and application software installed and patched can take time (less than the RTO; otherwise, a cold site would not be used). Not only is time an issue, but version incompatibilities can slow things down even more. The specific software versions used at the primary location also must be available for use at a cold site.

Then there’s the issue of data. Cold sites don’t continuously replicate with primary sites, so restoring data from backup locations (tape or cloud) is required. Cold sites are much less expensive than hot sites, but they must fit into an organization’s business continuity plan (BCP) to be acceptable. If it takes four days to get a cold site functional, for example, it will not fall within a two-day RTO, so a cold site may not be feasible to use in such a case.

Warm Site

A warm site provides a location with power and communication links, but it also has equipment in place and ready in case of a disaster; software and data, however, are not in place prior to a disaster.

Many organizations use bare-metal server restoration solutions to get server OSs up and running quickly without requiring manual installations and configurations. A bare-metal restoration performs a full system recovery, including the OS for a physical or a virtual machine, and it can be configured to do so even if the physical or virtual hardware configuration is different from the software in place when the system backup or image was taken.

Technicians may use external bootable USB drives to apply the bare-metal images, or a network Preboot Execution Environment (PXE) may be first to be configured to enable multiple simultaneous bare-metal deployments over the network.

Once OS and application software are installed, patched, and configured, data is required. This involves restoration from a chosen backup solution that is on-premises, in the cloud, or a hybrid of both. For example, the Amazon Web Services (AWS) Storage Gateway is a virtual machine that runs on a customer network and can present cloud storage as virtual tapes for on-premises backup software. Figure 8-2 shows the AWS Storage Gateway configuration screen.

Figure 8-2  Configuring the AWS Storage Gateway

EXAM TIP   Make sure you know what distinguishes one type of alternate site from another. Exam questions may test you on this using wording that differs from what is presented here, but the concepts are the same. For example, a question could link the RTO to a site type.

Data Replication

Having a readily available copy of up-to-date data is crucial with disaster recovery. Backups are still required, but data replication can immediately provide the data without requiring a restoration procedure. Replication can be implemented in plenty of ways, such as at the disk level, server level, and site level.

Synchronous replication writes to the primary and alternate location simultaneously; with asynchronous replication, there is a slight delay before the alternate write completes. Naturally, synchronous replication solutions tend to be more expensive than asynchronous ones, but with a short RTO, the cost of synchronous solutions could be justified, especially when you consider the fact that some data could be lost with an asynchronous solution.

Disk-to-Disk

In RAID 1 (disk mirroring) storage, a second copy of data is written to a disk other than the primary disk that stores the original data. Should the primary disk fail, the mirrored copy kicks in without missing a beat. This server component redundancy provides fault tolerance against disk failures.

Enterprise-class storage array vendors provide replication solutions for their disk array enclosures. The only issue is incompatibility; most vendor replication solutions work only with their own products.

The Linux tar Command  You can also use the Linux tar (tape archiver) command to create compressed archives for backup purposes. Commonly used tar command line parameters are shown in Table 8-1.

Table 8-1  Commonly Used Linux tar Command Line Parameters

For example, to create a compressed archive called UserFiles.tar.gz under /Backup from the /UserFiles folder, you would use the following:

tar -cvzf /Backup/UserFiles.tar.gz /UserFiles

To decompress the same archive and re-create the folder on /, you would use the following:

tar -zxvf /Backup/UserFiles.tar.gz -C /

The Linux dd command can also be used to back up specific disk blocks or even entire partitions. For example, the following example uses the dd command to back up (if means input file) the master boot record (MBR) of a bootable Linux disk (/dev/sda) to a backup file (of means output file) in /backup called sda_mbr_back. The bs means block size for the 512-byte first boot sector that contains the MBR.

dd if=/dev/sda of=/backup/sda_mbr_back bs=512 count=1

The following example restores the MBR to a disk (/dev/sda) from a backup file. Notice here we use only 446 bytes to retain the current partition table and disk signature on /dev/sda:

dd if=/backup/sda_mbr_back of=/dev/sda bs=446 count=1

Of course, there are many other file and disk backup solutions for Linux; tar and dd just happen to be built into most distributions.

Server-to-Server

Also called host-to-host replication, this solution uses software within the server OS to replicate data between two or more servers. The only issue here is that we are introducing more processing work for the server OS that really should be focusing on other tasks.

Windows DFSR  Windows Server OSs provide Distributed File System Replication (DFSR) as a role service that can synchronize folder contents between servers. Only file block changes are synchronized, and changes are compressed before being sent over the network.

Replication can be scheduled, or servers can be set to continuous replication. Bandwidth throttling can also be configured so that replication doesn’t consume all of the available bandwidth. Windows DFSR is considered asynchronous replication.

Server administrators can configure one or more servers in a DFSR replication group as read-only to prevent changes from that host. DFSR could be used to replicate data from branch office servers to a central server where data backups take place. The configuration of a DFSR replication group is shown in Figure 8-3.

Figure 8-3  Configuring a DFSR replication group in Windows

Plenty of third-party replication solutions are available for Windows with varying capabilities.

rsync  UNIX and Linux admins often use the rsync tool to replicate data between hosts. In addition, other rsync variants work on the Windows platform.

The rsync tool can be used to synchronize data between two or more local folders over an intranet or the Internet. As with Windows DFSR, only file changes are synchronized. The following example synchronizes the /budgets/2021 folder from a server named server2 to a local folder called /incoming/rsync. The -a preserves extra attributes such as permissions, -v is for verbose output, and -z compresses the transfer:

rsync -avz server2:/budgets/2021/ /incoming/rsync

As with Windows, plenty of third-party replication solutions are available for UNIX and Linux, with varying options.

Site-to-Site

Keeping data synced between sites may be required by service providers and emergency contingency organizations, for example, and these are prime examples of a primary and hot site. Instead of host-based replication solutions such as Windows DFSR or the UNIX-based rsync, for serious replication between data centers, more advanced (and expensive) solutions from vendors such as HP, IBM, or EMC (and many other vendors) would be used.

Cloud providers use site-to-site replication between their data centers to ensure that customer IT services and data are highly available in the event of a data center failure. Network links between data centers must be able to accommodate large data transfers quickly, especially if a synchronous replication solution is employed; these are often referred to as active/active copies of data, and they can provide a near-zero RTO. Multiple network links can be aggregated to provide network link high availability as well as increased network performance.

Site-to-site replication is not only costly but also complex. Technicians who are certified in the specific solution being used are needed to configure and maintain the replication environment.

EXAM TIP   Many exam questions will expect you to connect the dots. Remember that hot sites imply synchronous replication over high-speed network links.

Keep in mind that site-to-site synchronous replication won’t solve all of your headaches. Consider a malware infection in one data center that somehow goes undetected and gets replicated to other data centers, or a region-wide outage caused by inclement weather. Data backups beyond replication are still (and always will be) very important.

Business Impact Analysis

Two of the first activities related to risk management are identifying and prioritizing assets that have value to the organization. These tasks help you focus on allocating resources to implement security controls and mitigating risk, and you can determine how the loss of IT systems or data can negatively impact your organization.

Who and What Are Affected?

Prioritizing the impact of failed systems or data inaccessibility is part of a BIA. Even if a mission-critical database server has failed, if infrastructure services such as DHCP and DNS have also failed, they need to be made operational first.

Following is a sample list of DR priorities that will vary from one organization to the next:

•   Personnel safety

•   Critical organizational data

•   Network infrastructure hardware

•   Network infrastructure software

•   Mission-critical database servers

•   Front-end applications (that use the back-end database servers)

The RTO is a big factor in determining what type of failures can be tolerated and for how long. Organizations must sometimes consider their dependency on third parties for service high availability. Think of public cloud providers that have service level agreements (SLAs) with their customers that guarantee uptime, such as the SLA pictured in Figure 8-4. Resource allocation to protect critical IT systems is related to the amount of tolerable downtime.

Figure 8-4  An example of a public cloud provider SLA

EXAM TIP   Don’t confuse RTO with recovery point objective (RPO), which is discussed later. For the exam, remember that RTO is the maximum amount of tolerable downtime, and RPO is the maximum tolerable amount of data loss.

Business Continuity

Business operations must continue even in the face of natural and manmade disasters or technology failures. Preparation is the key. Where a business continuity plan takes a high-level approach to ensuring that the organization keeps running, disaster recovery plans are more specific to a technological solution.

Disaster Recovery Plan

A DR plan prepares an organization for potential negative incidents that can affect IT systems. Imagine a mission-critical database server running in a virtual machine that no longer boots. A DR plan is needed to get the server up and running again as quickly as possible. Presumably, if the server is that important, it has been made highly available through failover clustering, which is a server redundancy configuration. Nonetheless, the failed server still needs to be corrected. Server and application failover can be simulated before a disaster strikes to determine whether it will work correctly when needed.

DR plans include step-by-step procedures to recover failed systems such as a mission-critical database. Proper documentation makes this known to technicians who must know their roles in the DR plan. Periodic drills in a testing (not production) environment can streamline operations in the event of a real disaster.

Organizations also outsource IT expertise in some cases, such as with public cloud computing or synchronous replication solution vendors. A comprehensive DR plan will include details about these solutions as well as contact information in the event of a problem.

DR plans are effective only if the procedures are known and responsibilities are assigned. When roles and recovery steps are known, RTO is minimized. Table 8-2 lists common failure situations and responses that would be detailed in the DR plan.

Table 8-2  IT Failures and Solutions

Companies should have multiple DR plans for various IT systems. A DR plan document should contain items such as these:

•   Table of contents

•   Scope of the DR document

•   Contact information for escalation and outsourcing

•   Recovery procedures

•   Document revision history

•   Glossary

The mean time to repair (MTTR) is a measure of time that expresses, on average, how long it takes to get failed components back up and running. This helps with planning equipment life cycle costs and helps you quickly recover from failed components. A smaller MTTR value is desirable. The mean time between failures (MTBF) is usually associated with hardware components such as hard disks; based on past data, the manufacturer provides an estimate as to how much time should go by until a failure occurs.

Business Continuity Plan

The BCP ensures that business operations can continue or can resume quickly during or after an IT failure. It should also include preventative measures that show stakeholders that the organization is committed to being prepared for the worst. The BCP relates to the Continuity Of Operations (COOP) to keep business processes up and running at all times.

Backups are helpful in recovering from failure. The RPO relates to the amount of tolerable data loss and is normally associated with backup frequency. For example, if the RPO is 10 hours, backups must occur at least every 10 hours.

Creating and using a BCP involves the following steps:

1.   Assemble the BCP team.

2.   Identify and prioritize critical IT systems and data.

3.   Determine whether required skills are available internally or must be outsourced.

4.   Determine whether alternate sites (hot, warm, cold) will be used.

5.   Create a DR plan for each IT service.

6.   Review the BCP with the BCP team.

7.   Run periodic drills to ensure effectiveness.

Data Backup

Data replication technologies provide additional copies of data that are readily available, yet backups must still be performed as well. Figure 8-5 shows the backup feature available with the Windows Server OS.

Figure 8-5  Windows Server backup

The organization’s policies may be influenced by laws or regulations that specify how often backups must be performed, how long they must be retained, and in which country the data must reside. Most of today’s organizations have additional data backup options including offsite cloud backup solutions, although some types of data may be restricted from this type of backup. In some cases, printing highly classified information and storing it in a safe is considered a valid backup.

Backup Types

With today’s big data requirements, there are limitations to how much data can be backed up within a certain timeframe. Data center technicians must periodically reconcile backup software database references with the physical backup tapes themselves to ensure they exist.

In some cases, there just isn’t enough time to perform a nightly full backup of all data on an enterprise storage area network (SAN). In such cases, selective backups give server administrators the ability to restore only files that are required instead of overwriting all files as well as restoring to an alternate path from the original backup location.

Somewhat related to clustering, backup, and availability, Microsoft SQL Server log shipping uses a primary and secondary SQL server. The primary server database supports read/write access, and the secondary server data is updated via transaction log updates from the primary. This is sometimes referred to as a side-by-side backup.

File systems provide an archive attribute that can be turned on whenever a file is modified. Essentially, this flag means “I have been changed and I need to be backed up!” Not every backup solution uses the archive bit, but most do (and this can be configured in a GUI such as the Windows dialog shown in Figure 8-6), in addition to file date and time stamps. Different backup types will set the archive bit accordingly, which is explained in the following sections.

Figure 8-6  The archive bit of a Windows file

Full Backup

As the name implies, a full backup copies all data specified in the backup set. Technicians also call this a normal or copy backup. Full backups take longer than other backup options, but they take the least amount of time to restore, because all data is contained in a single backup set. As a result, full backups are commonly performed only periodically, such as once a week on weekends.

The archive bit for files is cleared when a full backup is performed. When backed up files are modified in the live system (not on the backup media), the OS turns on the archive bit so that the backup solution knows the file has changed since the last backup. This is also true when new files are created; the OS sets the archive bit on.

Differential Backup

This type of backup copies only the files that have changed since the last full backup (not since the last differential backup). So if you perform full backups on Saturdays and differential backups each weeknight, Wednesday night’s differential backup will copy all file changes since last Saturday (Sunday, Monday, Tuesday, and Wednesday).

Differential backups take less time to perform than full backups but more time to restore, because you need not only the full backup set but also the correct differential backup set that includes changes since the last full backup.

The archive bit is not normally cleared with this type of backup, because when the next differential backup runs, you’ll want to copy all changed files since the last full backup (where the archive bit is normally cleared).

Incremental Backup

Where differential backups copy files changes since the last full backup, incremental backups copy only files that have changed since the last incremental or full backup. For example, you might perform a full backup each Saturday and an incremental backup each weeknight. Wednesday evening’s backup will include only those files changed since Tuesday evening’s backup.

The archive bit is normally cleared when this type of backup runs, because you want to capture all changes each time the incremental backup is run. This backup type takes the least amount of time to run but the most time to restore.

EXAM TIP   Some backup solutions such as Veeam support combining backup types to facilitate restoration. Synthetic full backups take an incremental backup, and in the background, combine it with older, existing full backups in the same location.

Snapshots

Snapshots, also called checkpoints, can be taken of a virtual machine (VM), as shown in Figure 8-7, to capture its settings as well as data stored in virtual hard disk files. If problems are encountered with the VM in the future, it can be reverted to a previous snapshot. However, a VM snapshot should not be relied upon as the sole backup. Backup agents can be installed within each VM as would normally be done on physical servers to provide granular backup and restore options.

Figure 8-7  Taking a snapshot of a VMware virtual machine

EXAM TIP   For the exam, remember that snapshots do not replace backups. If you are required to restore specific items, such as specific files, VM snapshots will not do the trick; reverting a VM snapshot reverts the VM settings and virtual hard disk contents.

Other than virtual machines, snapshots can also apply to disk volumes, entire storage arrays, logical unit numbers (LUNs), hypervisors, and databases; they are often used in SAN environments, where they’re called storage snapshots.

Windows servers can have the built-in Volume Shadow Service (VSS) configured for each disk volume to enable scheduled snapshots (called volume shadow copies). The snapshots contain only changed disk blocks so they don’t consume much space. Many backup agents actually use the snapshots as their backup source; this eliminates the problem of backing up open files that are locked, which is one reason backups may fail. Windows users can also benefit from restoring previous versions of files or even undeleting files that have been removed from the Windows Recycle Bin.

Bare-Metal Backup

When servers will not boot or are not behaving and can’t be fixed, they may need to be reinstalled from an OS image. This is also true for VMs, although traditionally the term “bare metal” was used for physical servers. In a virtualization environment, a bare-metal hypervisor is the virtualization software that runs and interacts directly with host hardware, as opposed to running as an app within an OS.

Bare metal indicates that you have only the server (physical or virtual) and must install the OS, applications, configuration settings, and patches, all of which are included in a bare-metal backup. The system state, which can be backed up separately, is included and consists of the Windows Registry, Active Directory database, driver files, and so on. Data can also be included in a bare-metal recovery image. The idea is to get servers back up and running as quickly as possible in the event of some kind of problem, and the specific procedures should be a part of a DR plan. The Windows Server OS includes bare-metal backup options (Figure 8-8).

Figure 8-8  Windows Server bare-metal backup option

Some bare-metal solutions can also be used to deploy new servers quickly while changing unique identifiers such as server names, IP addresses, and licenses. Most bare-metal tools use recovery points, which are essentially snapshots of changes at various points in time. When performing a bare-metal recovery, you normally have a choice of snapshots, or recovery points.

Bare-metal solutions need some kind of a boot device, whether it’s USB or PXE network boot. Recovery of the OS, apps, and data can be done from local media or from a network server.

Backup Media

Now that you understand the types of backups and the reasons for creating backups, let’s consider where the backup data can be stored. You have numerous tape drive and media systems to choose from, depending on your capacity, speed, and archiving needs. Today’s standards include Linear Tape-Open (LTO), Advanced Intelligent Tape (AIT), and Digital Linear Tape (DLT), which are discussed in the following sections.

Where most tape media is accessed sequentially, or in linear fashion, standard disk storage, including USB drives and CDs, DVDs, and Blu-ray discs, supports random data access instead of having to find data at a specific place on tape media.

As with most technology, tape capacities, number of writes, and transfer speeds change frequently. Generally speaking, modern tape media has the ability to store about 2TB of compressed data with transfer rates ranging from 10 to 80 MBps. Depending on the media, you may get from 200 to 1000 writes before the media needs to be replaced.

Consider the following when choosing a backup solution:

•   What will be backed up?

•   Files

•   Bare-metal recovery images

•   Databases

•   Disk volumes

•   Storage arrays

•   Entire storage appliance

•   How much data will be backed up?

•   How much time is available to perform backups?

•   Which backup types will be used?

•   Full

•   Differential

•   Incremental

•   Snapshot

•   Bare metal

•   Are periodic restore drills run to ensure that valid backups are taken?

•   Is verify-after-write being used to ensure the integrity of backups?

•   Are backups being performed over slow network links?

•   What type of storage media will be used?

•   Hard disks

•   Cloud storage

•   Magnetic tape

•   Must data be archived for the long term?

Linear Access Tape

Linear access tape, often called Linear Tape-Open (LTO), is magnetic storage media that uses the Linear Tape File System (LTFS); it was introduced in 2010 and has since been revised several times. It offers large capacities, fast data seeks, and streaming, and it is commonly used with tape backup systems and for archiving. An XML file is used as a catalog of backed-up content on the LTFS and is not stored at the beginning of the tape, which makes access quicker (no need to rewind tape). LTFS can also be used as additional storage media for copying purposes, apart from backup purposes.

Advanced Intelligent Tape

Advanced Intelligent Tape (AIT) was introduced in the 1990s. This magnetic tape storage is used with tape backup and archiving systems and has been revised since its inception. Each AIT data cartridge contains a chip with metadata, which means that the backup catalog can be accessed quickly, regardless of what part of the tape is currently being accessed.

Digital Linear Tape

The Digital Linear Tape (DLT) standard (the industry standard) has been around since the 1980s and has been revised numerous times. Because of its 30-plus–year rating, DLT is often used for long-term archiving. DLT cartridges should be placed in protective cases to ensure long-term data storage. The SuperDLT (SDLT) standard supports larger capacities and transfer rates. You can use SDLT in older DLT systems, but only with read access.

On-premises Backup

Many organizations continue to use on-premises tape backup solutions instead of, or in addition to, cloud backup solutions.

As mentioned earlier, the AWS Storage Gateway is a virtual appliance that runs on-premises and enables backup solutions to “see” virtual tape devices for cloud backup purposes. Remember that a cloud backup is a type of offsite backup solution that is similar to physical backup storage media at another location.

Wherever backup media is stored, it needs to be physically secured. You may choose to encrypt backups for additional security. Backup media storage must be carefully considered—for example, you don’t want to discover that high humidity has destroyed your backups or archives when you need to restore data.

Physical and virtual servers can have backup agents installed for granular backup and restore options. Your backup solution may also support the backup of storage arrays and databases. You’ll also hear the term “tape library” used on occasion. This refers to a management solution for multiple tape devices and backup media used for backup purposes. Some tape libraries are robotic in that specific tapes can be mounted upon request for access to the backed-up data. Corrupt tape media can result in the inability to mount backup tapes, whereas hardware failures can result in “drive not ready” errors.

Cloud Backup

Over the last few years, individuals as well as organizations have begun trusting public cloud providers to store their data. Cloud backup is basically an extension of your office or data center network hosted on a provider’s equipment and accessed over the Internet.

The biggest showstopper for cloud backup adoption tends to be the perception that cloud security is lacking. Public cloud providers must undergo third-party security audits from various entities to ensure consumer confidence in their services. Because of economies of scale, cloud providers have the resources to secure IT infrastructure properly at a level that often exceeds what we can do in our organizations. Figure 8-9 shows the Microsoft Azure cloud service.

Figure 8-9  Azure is one of many cloud backup solutions.

Cloud Backup Security

The first security consideration is how to connect to the cloud provider’s data center. The standard is to connect over the Internet, but, from a security perspective, there are two alternatives:

•   Connect your network to the cloud provider over the Internet with a site-to-site VPN.

•   Connect your network to the cloud provider with a private network connection that bypasses the Internet.

The second issue is whether cloud backups are encrypted. Some cloud providers support server-side encryption; otherwise, you’ll have to encrypt data before backing it up to the cloud. Figure 8-10 shows an example of encryption options when you’re uploading files to the cloud.

Figure 8-10  Encryption options for cloud backup

Backup and Restore Best Practices

After you select a backup solution, you need to use and maintain it properly. Also, you’ll need to adopt a backup and tape rotation strategy. Tape rotation enables you to keep backups for a period of time, but you must also consider that, over time, the integrity of the storage media itself will fail; refer to vendor documentation for further details.

Although we will focus on the grandfather-father-son (GFS) tape rotation scheme, two other schemes warrant a mention:

•   Tower of Hanoi

•   Incremental rotation

Grandfather-Father-Son

GFS is the most common tape rotation strategy. Because the amount of available tape backup media is finite, media reuse is inevitable. Keep in mind that different tape media enable different numbers of writes to be performed.

The GFS rotation method uses three backup sets, such as daily, weekly, and monthly—where each tape is rotated on a schedule. You could use quarters and years as backup cycles for even longer term archiving. In our example, here’s where the nomenclature comes in:

•   Son  Daily backup cycle

•   Father  Weekly backup cycle

•   Grandfather  Monthly backup cycle

This means that on day seven, the Son tape becomes a Father and will be used next for weekly backups. Other daily tapes keep getting reused as the cycle continues. On week four, the Father becomes a Grandfather, and it will be used next for monthly backups. Monthly backups can then be stored offsite.

From a high-level perspective, the GFS rotation scheme enables you to back up file versions that are recent or that are months, or perhaps even years, old.

Other Best Practices

Many simple tasks such as the following can help contribute to a dependable backup solution:

•   Clear and concise backup media labeling

•   Data retention policy

•   Integrity verification (often referred to as read-after-write verification)

•   Backup media offsite storage

•   Backup media encryption

•   Backup media environmental controls

•   Periodic data restoration tests

Hands-on Exercises

Exercise 8-1: Configure the Volume Shadow Service on Srv2019-1

1.   Make sure you are logged into the Srv2019-1 virtual machine with the Administrator account (Fakedomain\Administrator) with a password of Pa$$w0rd172hfX.

2.   Start Windows Explorer.

3.   In the navigator on the left, click This PC. In the rightmost panel, right-click Local Disk (C:) and choose Properties.

4.   Open the Shadow Copies tab. Notice that each disk volume in the list shows “Disabled” under the Next Run Time column.

5.   Select C:\ and then click the Settings button.

6.   For the maximum size, set the Use Limit Value to 4000 MB.

7.   Click the Schedule button and select the boxes to the left of Sat and Sun to ensure that volume shadow copies are also taken at 7:00 A.M. on weekends. Click OK three times to return to Windows Explorer. Leave all screens open.

Exercise 8-2: Restore Previous Versions of Files in Windows

1.   On Srv2019-1 in Windows Explorer, on the right, double-click Local Disk (C:).

2.   In the right panel in a blank area, right-click and choose New | Folder. Enter Contracts for the folder name and press ENTER.

3.   Double-click the Contracts folder. Right-click in the right side of the screen and choose New | Text Document. Enter Contract_A for the filename and press ENTER.

4.   Double-click the Contract_A file and enter the following text in the file: Sample Contract Line One. Close Notepad by clicking the X in the upper-right corner and save the change.

5.   Click This PC on the left, and then right-click Local Disk (C:) and choose Properties.

6.   Open the Shadow Copies tab.

7.   Ensure that C:\ is selected and click the Create Now button to manually create a disk volume snapshot of drive C:\. Click OK.

8.   Double-click Local Disk C:\, and then double-click the Contracts folder.

9.   Double-click the Contract_A file, enter New Changes on a separate line, close Notepad, and save the changes.

10.   Right-click the Contract_A file and choose Restore Previous Versions.

11.   Notice the version of the file in the snapshot from a minute ago. Click the Open button at the bottom. Notice the text “New Changes” is not displayed because it did not exist when the snapshot was taken. Close Notepad. Close the Contract_A Properties dialog box.

12.   Select the Contract_A file. Press SHIFT-DEL. Choose Yes to delete the file permanently. The file will not be available in the Recycle Bin.

13.   In the address bar at the top, click Local Disk (C:).

14.   On the right, right-click the Contracts folder and choose Restore Previous Versions. Notice the version of the Contracts folder from when the snapshot was manually created earlier in this exercise.

15.   Click Open. Notice that the address bar at the top indicates how old the currently viewed folder contents are. Notice that the Contract_A file is listed; it can be undeleted from here.

16.   Right-click the Contract_A file and choose Copy. Close the newly opened Windows Explorer Contracts window. Close the Contract Properties dialog box.

17.   Double-click the Contract folder.

18.   Right-click in the white space on the right and choose Paste. The Contract_A file is restored. Double-click Contract_A. Notice the “New Changes” text is absent in the file; you have undeleted a version of the file that corresponds to when the snapshot was taken. Close Notepad but leave the server virtual machine running.

Exercise 8-3: Configure and Use Windows Server Backup

1.   On Srv2019-1, start PowerShell.

2.   Type get-windowsfeature *backup* to list server components that contain the word “backup.” Notice that the Windows Server Backup component is not installed (no X in the box).

3.   Because of word wrap in this book, sometimes the dash will look separated from the parameter. Keep them together, as in -includemanagementtools. Type the following:

4.   Once the installation has completed (if it seems stuck, press ENTER in the PowerShell window), click the Start button at the bottom left of the taskbar. Type back and wait for Windows Server Backup to appear; then click it.

5.   Click Local Backup on the left. Notice the Backup Schedule, Backup Once, and Recover options on the far right. Click Backup Schedule.

6.   On the Backup Schedule Wizard screen, click Next.

7.   Choose Custom and click Next.

8.   On the Select Items For Backup screen, click Add Items.

9.   Click the + symbol to the left of Local Disk (C:) and select the checkbox next to the Contracts folder. Click OK and then click Next.

10.   Once A Day is currently set to 9:00 P.M.; change this to 8:00 P.M., and then click Next.

11.   On the Specify Destination Type screen, choose Back Up To A Volume. Click Next.

12.   On the Select Destination Volume screen, click the Add button and choose drive I:\, which was created in an earlier lab for iSCSI virtual disk files. Click OK and then click Next.

13.   On the Confirmation screen, click Finish and then Close.

14.   On the far right in the Actions panel, click Backup Once.

15.   On the Backup Options screen, ensure that Schedule Backup Options is selected. Click Next.

16.   On the Confirmation screen, click Backup. When the backup status shows “Completed,” click Close. Note the backup status items in the middle of the screen. Leave the screen open.

17.   Open Windows Explorer and select Local Disk (C:).

18.   Select the Contracts folder. Press SHIFT-DEL. Choose Yes on the confirmation screen.

19.   Switch back to the wbadmin Windows Backup screen.

20.   In the Actions panel on the right, click Recover.

21.   On the Getting Started screen, ensure that This Server (SRV2019-1) is selected and click Next.

22.   On the Select Backup Date screen, accept the default and click Next.

23.   On the Select Recovery Type screen, ensure that Files And Folders is selected and click Next.

24.   Click the + symbol to the left of Srv2019-1. Do the same for Local Disk (C:).

25.   Select the Contracts folder and click Next.

26.   Accept the defaults on the Specify Recovery Options page and click Next.

27.   Click Recover.

28.   Once the status shows “Completed,” click Close.

29.   Switch to Windows Explorer and verify that C:\Contracts has been restored. If Windows Explorer was already open, press F5 on the keyboard to refresh the screen.

Exercise 8-4: Use the Linux tar Command for Data Backup

1.   Make sure you are logged into the Ubuntu-1 virtual machine with the uone account, with a password of Pa$$w0rd172hfX. Prefix each command in each exercise step with sudo to gain elevated privileges. You’ll need to enter the password again for uone the first time you issue a sudo command. Press ENTER after each command you issue in this exercise.

2.   Type mkdir /asia_contracts.

3.   Enter touch /asia_contracts/file{1,2,3,4}.txt to create four empty text files (file1.txt, file2.txt, and so on).

4.   Enter ls /asia_contracts to verify that the files have been created.

5.   Enter mkdir /backup.

6.   Enter tar -cvzf /backup/asia_contracts.tar.gz /asia_contracts. The c means create, v means verbose output, z means compress with gzip utility, and f means file. (Linux compressed tar filenames normally have a .tar.gz file extension, but this is not required.)

7.   Enter ls /backup to ensure that the compressed tar file was created.

8.   Enter rm -rf /asia_contracts to delete the folder and its contents. Type ls / to verify that there is no longer an /asia_contracts folder.

9.   Enter cd /backup.

10.   Enter tar -zxvf asia_contracts.tar.gz -C /. The x means extract, and the -C means extract to a specified path.

11.   Enter ls / to verify that the /asia_contracts folder has been restored.

12.   Close all windows.

Chapter Review

This chapter focused on proactive planning for dealing with negative incidents when they occur. The overarching premise is to restore business operations as soon as possible.

Disaster Recovery Sites

A hot site is a facility that includes power, communications, hardware, software, data, and staff. This is the most expensive type of alternate site to maintain. A warm site provides a location, power, equipment, and communications links, but not up-to-date data. A cold site consists only of a location, power, and communication links. A cold site is the least expensive type of alternate site.

Data Replication

Synchronous replication ensures that data is written to primary and alternate locations without delay; this results in an up-to-date mirror copy of data between a primary and a hot site and is often done in the background automatically. Asynchronous replication includes a slight delay before data is written to alternate sites; as a result, this is less expensive than synchronous solutions, but it can cause problems with applications depending upon database consistency. Replication can be configured to occur in a single direction or bidirectionally.

Disk-level replication solutions include disk enclosure (array) and disk mirroring solutions that are used within a site, not between sites. Server replication solutions include commonly used tools such as Windows DFSR and rsync. Constant replication over a high-speed network link can ensure fast data copies and data consistency across locations.

Business Impact

An inventory of assets is needed before related threats can be identified. This allows for the prioritization of assets and risks and helps you determine the impact that threats can have on business operations.

Assets include the following:

•   IT systems

•   IT processes

•   Business and manufacturing processes

•   Personnel

•   Data

•   Trademarks

The recovery time objective (RTO) determines the maximum amount of tolerable downtime. Disaster recovery plans must take the RTO into account.

Disaster Recovery Plan

A disaster recovery (DR) plan is used to bring failed systems online as quickly and efficiently as possible. The DR plan must be updated periodically to reflect changing threats.

The DR plan contains step-by-step procedures detailing exactly how systems are to be quickly recovered. All stakeholders must know their roles for the effective recovery of failed systems.

The DR plan includes the following:

•   Table of contents

•   DR scope

•   Contact information

•   Recovery procedures

•   Document revision history

•   Glossary

Business Continuity Plan

Where DR plans are specific to a system, a business continuity plan (BCP) is more comprehensive and is not as specific as a DR plan. The purpose of a BCP is to ensure that overall business operations resume quickly after a negative incident; this is also referred to as Continuity of Operations (COOP).

BCPs include preventative measures such as backup policies. The recovery point objective (RPO) indicates the maximum tolerable data loss and is related to backup frequency. So, for example, an RPO of 12 hours means backup must never be more than 12 hours old.

BCP activities include these:

•   Assemble a team.

•   Identify and prioritize assets.

•   Identify skill requirements to recovery systems.

•   Determine whether alternate sites will be used.

•   Create a DR plan for each IT system.

•   Review the BCP with the BCP team.

•   Conduct periodic BCP drills.

Data Backups

Backups are required even if disk mirroring or data replication solutions are being used. Virtual machine snapshots are point-in-time pictures of virtual machine settings and data. They are useful before making a critical change to a virtual machine, because they serve as a quick way to revert back to a known working configuration; however, they should never replace backups.

Take care when choosing a backup type, which can influence the amount of time taken to back up and restore data.

Common backup types include the following:

•   Full  All data is backed up and the archive bit is cleared.

•   Incremental  Data that has changed since the last full or incremental backup is backed up and the archive bit is cleared.

•   Differential  Data that has changed since the last full backup is backed up; the archive bit is not cleared.

•   Snapshot  Settings and data stored in virtual hard disk files and volumes are captured.

•   Bare metal  This backup enables the entire OS and data to be restored.

Important backup considerations include the following:

•   Amount of time to complete backup (backup window)

•   Backup devices and media being used:

•   Media capacity

•   Media lifetime

•   Backup data transfer speed

•   Cloud backup

•   Regulatory compliance

•   Data retention

•   Backup type

•   Backup media rotation strategy

•   Media labeling

•   Verification of backed-up data

•   Media encryption

•   Media offsite storage including cloud

•   Media storage environmental controls

•   Periodic restore drills

Backup rotation strategies are designed to retain data for a period of time and to reuse backup media. Common backup rotation strategies include Tower of Hanoi, incremental rotation, and grandfather-father-son (GFS). GFS is the most common backup rotation type and is used for long-term data archiving.

Questions

1.   Which of the following best describes RTO?

A.   The maximum tolerable amount of lost data

B.   The maximum tolerable amount of failed array disks

C.   The maximum amount of tolerable downtime

D.   The maximum tolerable amount of failed services

2.   Which type of disaster recovery site provides a facility with power and communications links only?

A.   Cold

B.   Warm

C.   Hot

D.   Basic

3.   Which factor enables up-to-date hot site data?

A.   Disk mirroring

B.   Cloud backup

C.   Synchronous replication

D.   Asynchronous replication

4.   Which common Linux tool synchronizes file systems between remote hosts?

A.   chmod

B.   CUPS

C.   NFS

D.   rsync

5.   Which type of replication provides a near-zero RTO?

A.   rsync

B.   Asynchronous

C.   DFSR

D.   Synchronous

6.   After identifying assets in a BIA, what should be done next?

A.   Prioritize assets.

B.   Assemble a BIA team.

C.   Create a DR plan.

D.   Assess risk.

7.   How can servers be managed when network connectivity is unavailable?

A.   iLO

B.   iDRAC

C.   RDP

D.   KVM

8.   You need to prevent a dual disk failure from bringing down a RAID 5 array. What should you do?

A.   Add two hot spares to the RAID 5 array.

B.   Add one hot spare to the RAID 5 array.

C.   Configure RAID 6.

D.   Configure RAID 1.

9.   Which type of backup does not clear the archive bit?

A.   Full

B.   Differential

C.   Incremental

D.   Bare metal

10.   Which backup type takes the longest to restore?

A.   Full

B.   Copy

C.   Incremental

D.   Differential

11.   Which type of backup takes the longest?

A.   Full

B.   Synchronous

C.   Incremental

D.   Differential

12.   Which type of restore should be used for operating system, data, and configuration settings that can be applied to different servers?

A.   Full

B.   Copy

C.   Bare metal

D.   Differential

13.   Your company uses an image to repair failed servers. Optical drives are disabled in all server UEFI settings. Which options can be used to boot and apply images? Choose two.

A.   CD

B.   USB

C.   DVD

D.   PXE

14.   What type of configuration redirects users from a failed server to another running instance of a network service?

A.   PXE

B.   Failover clustering

C.   NIC teaming

D.   Round-robin

15.   Which items would be available at a warm site? Choose two.

A.   Network links

B.   Data

C.   Staff

D.   Power

16.   Which requirement justifies the cost of a hot site?

A.   Low RPO

B.   High RPO

C.   Low RTO

D.   High RTO

17.   An SLA guarantees that user data will be available in at least one data center. What type of replication is needed between data centers?

A.   Hot

B.   Synchronous

C.   Warm

D.   Asynchronous

18.   An organization’s BCP stipulates that the RPO is five hours. How often should backups be performed?

A.   Less than the RPO

B.   Less than the RTO

C.   More than the RPO

D.   More than the RTO

Questions and Answers

1.   Which of the following best describes RTO?

A.   The maximum tolerable amount of lost data

B.   The maximum tolerable amount of failed array disks

C.   The maximum amount of tolerable downtime

D.   The maximum tolerable amount of failed services

C. The recovery time objective (RTO) relates to the maximum amount of tolerable downtime. A, B, and D are incorrect. The maximum tolerable amount of lost data relates to the recovery point objective (RPO). Various RAID levels determine how many failed disks can be tolerated. The RTO is not related to the maximum tolerable amount of failed services.

2.   Which type of disaster recovery site provides a facility with power and communications links only?

A.   Cold

B.   Warm

C.   Hot

D.   Basic

A. Cold sites provide a facility with power and communications links only. B, C, and D are incorrect. Warm sites provide power, communications links, as well as equipment and software, but lack up-to-date data. Hot sites provide a facility with power, communications links, equipment, software, up-to-date data, and staff. A basic site is not a type of disaster recovery site.

3.   Which factor enables up-to-date hot site data?

A.   Disk mirroring

B.   Cloud backup

C.   Synchronous replication

D.   Asynchronous replication

C. Writing up-to-date data simultaneously to multiple locations is called synchronous replication and is often used between a primary and hot disaster recovery site. A, B, and D are incorrect. Disk mirroring is not used to replicate data between sites. Cloud backup normally relies on a schedule. Asynchronous replication introduces a delay before writing to alternate sites.

4.   Which common Linux tool synchronizes file systems between remote hosts?

A.   chmod

B.   CUPS

C.   NFS

D.   rsync

D. rsync is often used in Linux to synchronize file systems between hosts. A, B, and C are incorrect. chmod is used to set Linux file system permissions. Common UNIX Printing System (CUPS) is a Linux print server. Network File System is a Linux network file system standard.

5.   Which type of replication provides a near-zero RTO?

A.   rsync

B.   Asynchronous

C.   DFSR

D.   Synchronous

D. A near-zero recovery time objective (RTO) means very little tolerance for downtime; this is provided by synchronous replication. A, B, and C are incorrect. rsync and DFSR are asynchronous replication and they do not provide near-zero RTO.

6.   After identifying assets in a BIA, what should be done next?

A.   Prioritize assets.

B.   Assemble a BIA team.

C.   Create a DR plan.

D.   Assess risk.

A. After asset identification, prioritization must occur. B, C, and D are incorrect. The business impact analysis (BIA) team would already be assembled if assets have been identified. The disaster recovery (DR) plan and risk assessment do not happen until assets are prioritized.

7.   How can servers be managed when network connectivity is unavailable?

A.   iLO

B.   iDRAC

C.   RDP

D.   KVM

D. Keyboard, video, mouse (KVM) switches can be used to administer servers locally. A, B, and C are incorrect. iLO, iDRAC, and RDP are remote management tools that rely on network connectivity.

8.   You need to prevent a dual disk failure from bringing down a RAID 5 array. What should you do?

A.   Add two hot spares to the RAID 5 array.

B.   Add one hot spare to the RAID 5 array.

C.   Configure RAID 6.

D.   Configure RAID 1.

C. RAID 6 can tolerate two disk failures. A, B, and D are incorrect. RAID 5 can tolerate a single disk failure. RAID 1 can tolerate a single disk failure.

9.   Which type of backup does not clear the archive bit?

A.   Full

B.   Differential

C.   Incremental

D.   Bare metal

B. Differential backup must capture all changes since the last full backup and thus does not clear the archive bit for backed-up files. A, C, and D are incorrect. Full and incremental backups do clear the archive bit when backing up files. Bare-metal restores are not related to archive bits.

10.   Which backup type takes the longest to restore?

A.   Full

B.   Copy

C.   Incremental

D.   Differential

C. Restoring using incremental backups means restoring the last full backup and each incremental backup to the point of failure. A, B, and D are incorrect. Full and copy backups are the quickest to restore since only a single backup set is needed. Differential backups are the next quickest to restore following full.

11.   Which type of backup takes the longest?

A.   Full

B.   Synchronous

C.   Incremental

D.   Differential

A. Because everything is being backed up, full backups take the longest to complete. B, C, and D are incorrect. Synchronous, without being discussed in a specific context, is not a backup type. Incremental backups take the least amount of time; only changes since the last full or incremental must be captured. Differential backups capture all changes since the last full backup.

12.   Which type of restore should be used for operating system, data, and configuration settings that can be applied to different servers?

A.   Full

B.   Copy

C.   Bare metal

D.   Differential

C. Bare-metal backups can be used to restore an entire operating system, applications, and data quickly, even to a new server. A, B, and D are incorrect. Full, copy, and differential backups are not designed to restore operating systems, applications, and data to different servers.

13.   Your company uses an image to repair failed servers. Optical drives are disabled in all server UEFI settings. Which options can be used to boot and apply images? Choose two.

A.   CD

B.   USB

C.   DVD

D.   PXE

B, D. USB local boot and PXE network boot do not rely on optical media. A and C are incorrect. CDs and DVDs are optical media.

14.   What type of configuration redirects users from a failed server to another running instance of a network service?

A.   PXE

B.   Failover clustering

C.   NIC teaming

D.   Round-robin

B. Failover clustering uses multiple servers (nodes), each having the same network service and access to the same data on shared storage. If a server fails, users get redirected to the network service on a running server. A, C, and D are incorrect. PXE is a network boot standard. NIC teaming groups server NICS together for load balancing or aggregated bandwidth. Round-robin is a term often used with DNS where there are multiple A records with the same name, each pointing to a different IP address.

15.   Which items would be available at a warm site? Choose two.

A.   Network links

B.   Data

C.   Staff

D.   Power

A, D. Warm sites include network links and power; they are missing only staff and up-to-date data. B and C are incorrect. Data and staff are available at hot sites but not warm sites.

16.   Which requirement justifies the cost of a hot site?

A.   Low RPO

B.   High RPO

C.   Low RTO

D.   High RTO

C. A low RTO means very little tolerance for downtime. Hot sites align with this requirement. A, B, and D are incorrect. Recovery point objective (RPO) relates to the amount of tolerable data loss and does not align to a hot site as RTO does.

17.   An SLA guarantees that user data will be available in at least one data center. What type of replication is needed between data centers?

A.   Hot

B.   Synchronous

C.   Warm

D.   Asynchronous

B. Synchronous replication between data centers means there is no delay when writing data. This aligns with SLA guarantees in this context. A, C, and D are incorrect. Hot and warm replication do not exist. Asynchronous replication introduces a delay from the primary write.

18.   An organization’s BCP stipulates that the RPO is five hours. How often should backups be performed?

A.   Less than the RPO

B.   Less than the RTO

C.   More than the RPO

D.   More than the RTO

A. The RPO defines the maximum amount of tolerable data loss. If the RPO is five hours, then backups must occur within this timeframe. B, C, and D are incorrect. The RTO does not apply in this scenario as well as RPO does.

CHAPTER 3

Server Operating Systems and Server Roles

In this chapter, you will

•   Learn about server roles

•   Understand the benefits of virtual servers

•   Apply server licensing and installation methods

•   Know when to use various server administration methods

•   Recognize how scripting can automate server administration

•   Understand the importance of asset management and documentation

•   Learn about patch management

•   Install Windows Server 2019

•   Install Ubuntu Linux 20.04.1

Servers are the core of network services. Network operating systems (NOSs) such as UNIX, Linux, and Windows can be used for most standard uses such as file servers, mail servers, and directory servers, but in some cases a line of business application will require a specific platform.

Server Roles

Servers are deployed to offer services that provide some kind of business value to an organization. For example, Domain Name System (DNS) servers provide a name-to-IP address lookup service, mail servers enable communication through e-mail messages, and so on. Planning these roles includes determining whether multiple roles will be co-located on the same server or spread out among multiple servers, which can be physical or virtual.

In the cloud, customers can quickly provision and deprovision virtual servers as needs dictate. Cloud providers such as Microsoft Azure, shown in Figure 3-1, offer virtual machine templates that customers can use to deploy not only the server OS but also additional services, such as a MySQL database server virtual machine.

Figure 3-1  Virtual machine templates available in the Microsoft Azure cloud

Cloud virtual machines can offer services not only to other devices running in the cloud but also to Internet consumers and on-premises devices. Connectivity with on-premises devices can be accomplished with the following:

•   Site-to-site virtual private network (VPN) connections

•   Dedicated connections from on-premises networks to cloud provider networks, bypassing the Internet

After server roles are installed and configured, these services must be enabled to ensure that the service is running when the server comes up. The installation, configuration, and management of server roles vary depending on the specific server OS version. Figure 3-2 shows the Add Roles And Features Wizard that is used to add roles to a Windows server.

Figure 3-2  Installing a Windows server role with the Add Roles And Features Wizard

Infrastructure Roles

The network infrastructure enables devices to communicate with one another. This begins with hardware such as network cables, connectors, routers, switches, network cards, wireless access points, and so on. Then the software components provide network infrastructure services, and this is where our in-depth discussion begins.

DHCP

IPv4 is the standard software communication protocol suite used by modern network devices, although IPv6 is gaining traction. With both IPv4 and IPv6, the Dynamic Host Configuration Protocol (DHCP) is used to provide central IP settings that are delivered to network nodes. This saves technicians from having to configure IP settings manually on each and every device.

Chapter 5 dives into the DHCP packet exchange between DHCP clients and servers. A DHCP server can run on a server OS, or it may run as a service on a router, including a wireless router. DHCP listens for client connections on User Datagram Protocol (UDP) port 67, so firewalls between DHCP clients and servers must allow this traffic to access the DHCP server. Traffic to the DHCP client is addressed to UDP port 68. After the DHCP server role is installed on a server, it must be configured to support the needs of the network, as discussed in the following sections.

DHCP Scopes  The first thing that gets configured with DHCP is the scope. Scopes are IP settings grouped together into a manageable unit; they must be activated before they can be used in the DHCP process. Table 3-1 shows common scope settings.

Table 3-1  DHCP Scope Options

DHCP Vendor Classes  When communicating with a DHCP server, a network device sends information regarding what type of device it is. For example, a Cisco or Nortel IP phone, an Apple iPhone, Android phone, and HP network printer can all be easily identified. But how is this useful?

DHCP vendor classes, like the one shown in Figure 3-3, let you apply specific IP settings to certain types of network devices. For instance, you could assign an IP address range, default gateway, and DNS server, specifically to Cisco IP phones. This way, your IP phone traffic could be on an isolated network.

Figure 3-3  DHCP vendor class for Nortel IP phones

You must first determine what specific vendor class data is included in the network transmission. You can find this information by searching the Internet, by visiting the vendor’s web site, or by capturing network traffic related to a specific device type during DHCP transmissions.

APIPA  DHCP is a critical infrastructure service, and without it, device communication can be a problem. When DHCP clients can’t reach a DHCP server, they auto-configure themselves using Automatic Private IP Addressing (APIPA).

APIPAs fall in the 169.254.0.1 to 169.254.255.254 range, where 169.254.255.255 is the broadcast address for this network. The client device assigns itself a unique address on the LAN, but the device will not be able to communicate outside of the LAN, and within the LAN it can communicate only with other APIPA hosts. Once DHCP is reachable, the APIPA is no longer used on the network interface.

From the command prompt on a Windows computer, you use the ipconfig command to work with DHCP. The ipconfig /all command shows network details, including whether DHCP is being used, and, if so, the IP address of the DHCP server along with lease information. You’ll find more detail about this in Chapter 5.

IPv6 does something similar, but not exactly the same. A link-local IPv6 address is a unique self-assigned address, but it is always bound to the network interface whether or not DHCP is reachable. Actually, it is used even if you manually configure IPv6 on a host. This type of address has an FE80 network prefix, and it’s used by IPv6 for network communications on the local link, otherwise referred to as a subnet.

When determining the best configuration options for your DHCP scopes, consider the following:

•   Talk to the network infrastructure team to determine which valid IPv4 or IPv6 address ranges can be used.

•   Environments where clients are connected for short periods of time should have short lease durations to maximize IP address reuse.

•   Try to specify at least two default gateways for remote network connectivity in case one router becomes unavailable.

•   Try to specify at least two DNS servers in case one becomes unavailable.

•   For multihomed (multiple network card) DHCP servers, configure DHCP bindings for the correct network interface.

•   Think high availability. What happens if your single DHCP host crashes? Windows servers enable two DHCP hosts to replicate DHCP configuration and lease data between each other.

DNS

DNS is a lookup service, and, much like DHCP, without it, most network communication grinds to a halt. It is most often used to look up an IP address when given a fully qualified domain name (FQDN). Let’s say, for example, that ServerA needs to download updates from windowsupdate.microsoft.com. A DNS query will be sent from ServerA destined for UDP port 53 on ServerA’s configured DNS server. The DNS server will return the IP address for windowsupdate.microsoft.com to ServerA. This is a DNS forward lookup.

Reverse lookups do the opposite: given an IP address in a DNS query, the DNS server looks up and returns the FQDN. This can be useful if you’re looking through firewall logs and notice suspicious activity from a certain IP address and would like to find out the associated host or domain name. Some security appliances can be configured to do this automatically, but at a cost of slowing down the device. Reverse lookups are also commonly used with mail servers as a simple verification method for other connecting Simple Mail Transfer Protocol (SMTP) servers.

DNS Domains  DNS is a hierarchy that begins at the top with the root domain. Under the root domain are top-level domains (TLDs) that we’ve all heard of—.com, .org, .net, .mil, .gov, .beer, .uk, and so on—that are maintained by DNS root servers. Figure 3-4 shows the default root hints configured on a Windows DNS server that enable the Windows DNS server to resolve Internet names.

Figure 3-4  Setting Windows DNS server root hints

Companies and individuals can register a unique DNS domain name through a DNS authority such as FreeDNS, GoDaddy, and others. The DNS domain for a company reflects its Internet presence, such as mheducation.com. The internal network for a company might use a different DNS domain name such as mheducation.local. Some services such as Microsoft Active Directory Domain Services (AD DS) require and create a DNS domain in order to function.

A domain, such as mheducation.local, can have subdomains. Examples include sales .mheducation.local and hr.mheducation.local, which could each have data stored on a different DNS server. In this case, a DNS server controlling the data for only mheducation.local is said to be authoritative over the mheducation.local zone. Another DNS server would be authoritative over the sales.mheducation.local zone, and so on.

DNS Resource Records  DNS domains contain resource records (RRs), as shown in the DNS Manager screen in Figure 3-5. Different types of RRs are used for different purposes—for example, DNS A records are used to look up IPv4 addresses when a FQDN is provided, and mail exchange (MX) records are used to find SMTP mail servers. Table 3-2 lists common RR types and their uses.

Figure 3-5  DNS resource records from DNS Manager

Table 3-2  DNS Resource Record Types

WINS

Prior to Windows 2000, Microsoft TCP/IP networks relied on the Windows Internet Name Service (WINS) to resolve NetBIOS computer names (maximum 15 characters) to their respective IP addresses. Legacy software may still require this on modern networks, but let’s face it, that would be the exception and not the rule!

WINS is a centralized and replicated database of NetBIOS computer names and their IP addresses; there is no naming hierarchy as there is with DNS. It is installed as a “feature” (as opposed to a “role”) on Windows Server 2019 for backward compatibility. Like DNS, client devices needing WINS must point to the IP address of one or more WINS servers. In the past, client systems each had an LMHOSTS file containing NetBIOS names and IP addresses.

An available alternative is the DNS GlobalNames zone. Instead of WINS, client devices can point to a DNS server, where a zone literally called GlobalNames exists. DNS admins create CNAME (alias) resource records that point to DNS A records. This enables older software using flat computer names to function through DNS.

NTP

Time is of the essence; this is so very true with computer networks, because so many operations depend on accurate date and time stamps. It’s crucial for all devices on the network to agree on the date and the time—log file entries, Microsoft Active Directory (AD) user logon time stamps, and many other activities depend on it!

Network Time Protocol (NTP) is a service that runs on a network host, whether it is UNIX, Linux, Windows, or a Juniper Networks router; it can run on anything, and there are thousands of NTP servers on the Internet. Http://pool.ntp.org is widely used to provide time synchronization for Internet devices.

NTP Tiers  NTP is a network service that listens on UDP port 123 for time requests, and there can certainly be more than one NTP server on a network. Different tiers, or stratums, of NTP hosts exist:

•   Stratum 0  Time source, or reference clock

•   Stratum 1  NTP server connected to Stratum 0 device

•   Stratum 2  NTP server gets time over the network from a Stratum 1 host

These stratums imply the delays involved with getting time packets sent over the network in the first place. A Stratum 2 NTP server might be off from UTC time by 10 milliseconds, for example, where a Stratum 1 NTP server might be off by only 1/2 millisecond. Figure 3-6 shows the NTP status on the Windows operating system.

Figure 3-6  Viewing NTP status on a Windows Server

Directory Services

A directory service (DS) is a centralized network database containing objects such as the following:

•   Users

•   Groups

•   Computers

•   Network service locators

•   Shared folders

•   Shared printers

•   Software licenses

In the enterprise, this normally means replicating the DS data among servers for redundancy and performance benefits. If one server fails and you’re using DS for user authentication, other remaining servers can handle the authentication. Of course, these DS servers need to be locatable on the network, normally via DNS.

Microsoft network environments tend to use Microsoft AD DS, but there are many other options including OpenLDAP, Oracle Directory Services, and IBM Tivoli Directory Server. These solutions are all based on essentially the same Lightweight Directory Access Protocol (LDAP) standards.

Microsoft Active Directory  LDAP provides access to a central network database over an IP network. It listens on TCP ports 389 and 636 (plaintext and encrypted, respectively). Microsoft AD DS, or simply AD, is LDAP-compliant.

AD is a replicated network database that is synchronized between domain controllers (DCs). A DC is a server that is configured to hold a replica of the AD database, which by default lives on the DC at C:\Windows\Ntds\Ntds.dit.

Windows enterprise environments join computers (Windows clients and servers, Linux hosts, and so on) to the AD domain for the purposes of centralized administration (through Group Policies) and centralized authentication. Users with accounts in AD can log on using that account on any domain-joined computer—in other words, we don’t have to create an account for user Bob on every computer with the same password; creating it once in AD suffices.

NOTE   Only a small subset of Group Policy options are used by certain Linux distributions. Consult the documentation for your specific variant of Linux.

DCs are discovered by clients through DNS queries. The creation of a DC also creates DNS service location records, which clients use to find the nearest DC. Clients need the DC not only for authentication but also to periodically pull down Group Policy settings configured by the Windows administrator. In other words, AD needs DNS.

AD is a Windows Server role and can be installed and managed using the following:

•   Windows PowerShell cmdlets  Commands that enable automation

•   Server Manager  GUI tool on the server or the client

Other Server Roles

We have jobs in IT because we use technology to solve business problems. There are other server roles beyond the basic infrastructure role mentioned so far that you need to understand. Some roles may be on their own server, but you can also co-locate multiple roles on a single server; it depends on the role and the scale of work it will be performing.

Web Server

Web servers use the HyperText Transfer Protocol (HTTP) or its secured variant (HTTPS) to present content to a web browser. The following ports are normally used on a web server:

•   TCP 80  Not encrypted

•   TCP 443  Encrypted with Transport Layer Security (TLS); Secure Sockets Layer (SSL) is the predecessor and is deprecated

Administrators can choose a different port if they want. The web server transmits data to clients on a higher numbered port such as 45000. If SSL or TLS will be used, a Public Key Infrastructure (PKI) certificate is required for the web server (not clients). Check out Chapter 6 to learn more about crypto and PKI.

Client web browsers normally use DNS to resolve FQDNs to IP addresses; this is so much easier than typing in a difficult-to-remember IP address in the browser’s address bar.

Common web server products include

•   Microsoft Internet Information Services (IIS), shown in Figure 3-7

Figure 3-7  Microsoft IIS web server management tool

•   Apache

•   NGINX (engine X)

Simply stated, a web server listens for HTTP connections and delivers data back to client web browsers. It can become more involved than that, however.

Developers can build static HTML web pages that sit on the web server and are transmitted to clients upon request. Developers can also use server- or client-side scripting languages such as Python (server-side) or JavaScript (client-side) that can dynamically generate page content or take specific actions based on conditions. Client-side scripting is used less often, where possible, because of the security implications of running that code locally on a client computer.

Web server authentication to protected web sites is often performed by an underlying DS, whether the web site is on-premises or in the cloud. Using web Single Sign-On (SSO) means using a single identity store, even between different companies: this is called identity federation.

Application Server

Most of us probably think of database servers when we hear the term “application server.” Although this is partially true, there’s more to application servers than that.

Many people confuse web, database, and application servers. The web server is basically an HTTP engine; it doesn’t address a specific business solution. A database server is essentially a container that could be used for storage and retrieval of relevant data. Now, if our company’s developers build a travel expense application available on the HTTP web server that stores data in a back-end database, we can say we now have an application server; it serves a specific business need.

Common application server database engines include these:

•   Microsoft SQL Server

•   MySQL

•   Oracle Database

If you are building and testing a web application, the cloud comes in quite nicely. It takes very little time to spin up a bunch of virtual machines, some of which are HTTP or database servers. Then once development ceases, you can deprovision these virtual machines so you no longer get charged for them—sounds like a great idea!

File Server

Despite the popularity of cloud storage, file servers are still very important in the enterprise. It’s safe to say that accessing your enterprise network probably performs better than accessing files over the Internet. Sometimes laws or regulations leave us no choice; files must be stored on equipment owned and managed by the company and not a cloud provider.

Windows servers use the Server Message Block (SMB) protocol to make shared folders available to users over the network. Administrators must assign the appropriate share and NTFS file system permissions to access control lists (ACLs) to give user access; you’ll read more on this in Chapter 6.

There are plenty of ways to share folders in Windows (individual files cannot be shared), but here’s how to do it using PowerShell:

On the client side, we could map a drive letter to the Projects share as follows:

Net use g: \\server1\projects

Although UNIX and Linux systems can participate in an SMB network using Samba, they can also use their native Network File System (NFS). On the sharing host, the /etc/exports file contains details about which folders clients can mount (only Windows uses drive letters) over the network.

These days, many organizations such as legal firms have turned to document management systems such as Microsoft SharePoint Server or Hummingbird DOCS Open, which make it easy to work with multiple file versions, metadata, and many other document actions.

Print Server

As the name implies, a print server manages the printers on a network. Print servers also spool print jobs from clients using server disk space. Depending on your environment, you may not need or use a print server; instead, client devices can be configured to print directly to network-based printers, but this lack of centralized management control can prove challenging on a larger network.

A print server acts as an intermediary between clients that want to print and the physical printer devices; security and printer settings for many printers can be managed using a centralized administrative tool. Windows shared printers can of course be configured in the GUI by right-clicking a printer name, and they can also be shared using PowerShell as follows:

Set-Printer -Name printer1 -Shared $True -ShareName printer1share

Cloud Printing  The idea of cloud printing is to remove any printing dependencies such as operating system versions, print drivers, printing devices, and so on. In addition, cloud printing can be used with mobile devices, which do not offer great printing support—certainly not for a large variety of printing devices.

Many mobile device users save files that they want to print to a cloud storage account that they then access from a laptop or desktop that supports printing. But there’s a better way—cloud printing to the rescue! If your mobile device apps don’t support cloud printing, don’t worry, because there are helper apps for Android, Windows, and iOS devices.

Mail Server

You can run several different types of mail solutions on your server, whether on-premises or in the cloud. They all run as services (or daemons) that enable connections on specific ports, as listed in Table 3-3. Always remember that most network services enable the port number to be changed and that using an encrypted connection means using a different port number.

Table 3-3  Common Mail Protocols

With so many people in the workforce using mobile devices, your mail server will have to accommodate mobile device connections. Of course, the appropriate mobile device e-mail apps will have to be installed and configured correctly.

With bring your own device (BYOD), where employees can use their personal mobile devices for work, mobile device partitioning solutions enable the use of a single mail app for both personal and work e-mail. Most modern mobile device management (MDM) tools support this. Additionally, configurations may, for instance, restrict file attachments from corporate e-mail messages from being stored on personal cloud storage locations. MDM tools can run on-premises or in the cloud.

Routing and Remote Access Service

The server role normally uses at least two network interfaces connected to different networks. Servers with more than one interface are said to be multihomed. Windows server administrators use Routing and Remote Access Service (RRAS) to configure the following:

•   IPv4 and IPv6 routing

•   Network address translation (NAT)

•   Virtual private networks, as shown in Figure 3-8

Figure 3-8  RRAS configuration wizard

Say, for example, that you want to configure a NAT router to enable multiple internal stations to access the Internet through a single public IP address. This requires both a public and a private network interface connected to the appropriate networks. Clients simply point to the internal NAT router interface as their default gateway. (For more on IP and default gateways, be sure to devour Chapter 5.) IP routing is used to send network traffic between different subnets. Configuring this requires at least two interfaces in the host.

VPNs enable clients to connect securely to a private destination network over an untrusted network such as the Internet. VPN client software on a device establishes an encrypted tunnel with a VPN host on the work network (must be reachable by clients over the Internet). Anything sent through the tunnel is encrypted. The VPN host then decrypts the traffic and sends it on its way to the Internet network.

Plenty of UNIX and Linux solutions provide RRAS services, including the following:

•   IP routing using the ip command

•   NAT configuration using the iptables command

•   OpenVPN

Virtualization Servers

Virtualization technology (VT) is hot these days, but it’s not new technology. Mainframes have long decoupled applications and user environments from the underlying hardware to enable multiple concurrent isolated computing sessions.

We must also consider the different types of virtualization, including operating system virtualization (this is what most techies think of), user desktop virtualization, application virtualization, and so on. Our focus will be on operating system virtualization.

Common modern virtualization solutions include these:

•   VMware vSphere Hypervisor

•   Microsoft Hyper-V

•   Citrix Hypervisor

•   Oracle VM VirtualBox

The combination of slim-profile physical servers (blades) along with running virtual server operating systems maximizes the possible server density in a small server room or a large data center facility. If you monitor hardware use over time for a physical server, in many cases you’ll find that, overall, the hardware isn’t being fully utilized, and you aren’t getting the biggest bang for your buck.

Virtualization is a better use of hardware resources, where multiple virtual machines (VMs) are running simultaneously and sharing the underlying hardware, but each VM doesn’t manage hardware access: that’s the job of the hypervisor.

Hypervisor Types

There are a few types of hypervisors, and each has its place in certain computing environments. One hypervisor might work well on a developer’s laptop, while a different type of hypervisor is best for mission-critical applications. Many companies often use a hybrid of hypervisor solutions. When discussing virtualization, the hypervisor is often called the “host” and each virtual machine is called a “guest.”

Some hypervisors require specific hardware capabilities such as Intel Virtualization Technology (Intel-VT) or AMD Virtualization (AMD-V hardware virtualization support built into the BIOS or UEFI). If you plan on creating a cluster of multiple hypervisor nodes for VM high availability and scalability, moving VMs from one cluster node to another could require physical CPUs to be similar or exactly the same on each node; consult your specific hypervisor documentation to see if this is the case.

Type 1

This type of hypervisor is used for more serious virtualization environments. The hypervisor itself has direct access to physical hardware, and it controls hardware resource access between VMs. You’ll hear this sometimes referred to as a bare-metal hypervisor.

The less stuff running, the quicker it is to patch and the more secure your system. Because Type 1 hypervisors don’t rely on another operating system, they have the benefit of increased security over Type 2 hypervisors.

Examples include

•   Microsoft Hyper-V Server

•   VMware ESXi

Type 2

This type of hypervisor is an application that runs on top of an existing operating system. This means the hypervisor does not have direct access to hardware; the underlying operating system does.

Examples include

•   VMware Workstation Pro (Figure 3-9)

Figure 3-9  VMware Workstation, a Type 2 hypervisor

•   Oracle VM VirtualBox

Hypervisor Host Configuration

Running a bunch of VMs at the same time on one set of hardware requires careful planning. It’s not really about the number of VMs (VM density), but rather what type of IT workloads will be running inside those VMs. An SMB file server used by 50 people, for example, won’t need as much horsepower as a Microsoft SharePoint Server used by 5000 people.

Let’s take a look at planning physical hardware for a Type 1 hypervisor in Table 3-4. Remember to read the documentation for your specific solution to see what is and is not supported. For further hardware details refer back to Chapter 2.

Table 3-4  Type 1 Hypervisor Hardware

Virtual Machine Guest Configuration

Creating a VM (not installing the OS) is like planning the physical hardware for a new server. How much memory, CPU, disk, and network capacity do you need? The answer, of course, depends on the IT workload the server will be running.

VM settings, as shown in Figure 3-10, include the following:

Figure 3-10  Virtual machine settings

•   Amount of startup, minimum and maximum, and dynamic memory

•   Number of vCPUs and compatibility settings

•   Storage such as virtual hard disk files, raw disk space, and SAN storage

•   Virtual network interface cards (vNICs) and their connected virtual switches, virtual MAC address, network bandwidth throttling, and VLAN tag settings:

•   Bridging  Connects to the physical network

•   NAT  Uses the hypervisor host IP address to access the network

•   VM to VM  Enables communication only between VMs

•   VM and host  Enables communications between VMs and the hypervisor host

•   Display settings for number of monitors and accelerated graphics

•   Integration tools with the host hypervisor for time synchronization, backup services, and so on

•   Snapshot/checkpoint settings

Some virtualization solutions provide an integration tools installer that optimizes VM display settings, keyboard and mouse movement, time synchronization with the host, and other settings. Check your hypervisor’s details to make sure you’re getting the most out of your VMs.

Server Installation

Hardware compatibility lists (HCLs) provide details about which specific hardware is supported by a given server OS. You also have to consider the requirements for specific drivers and applications. You may have to supply device drivers during installation if they aren’t detected by the installation program. Server OS minimum requirements must be met, such as Windows Server 2019 requiring a minimum of 2 GB of RAM for a server with the GUI Desktop Experience installation. The crucial aspect of this is ensuring that adequate hardware resources exist to support server workloads.

Server Licensing

Installing and managing servers includes acquiring and tracking software licensing. Open-source licensing applies to some software such as Ubuntu Linux, where the use of default Ubuntu software does not incur a licensing fee, but there are some requirements such as sharing code modifications with the Linux community. Even though some open-source solutions are free, technical support is not.

Some licensing models are based on the server itself (per-server) or in some cases specific to virtual machine server instances (per-instance). For larger enterprises, you can configure a licensing server such as Microsoft Key Management Service (KMS) server that issues and tracks licenses for an entire site. Of course, valid server licenses would have to be made available on this licensing server. This is often accomplished with volume licensing, where a single key can be used to activate a large number of products from a vendor.

Some software such as Microsoft SQL Server use per-core licensing, where a physical or virtual CPU consists of one more CPU cores. Some products apply licensing at the physical CPU socket level, so more physical CPUs means more compute power but also more licensing costs. Some vendor software licensing models, such as the one for Ansys 3D design software, supports current and older versions and sometimes future versions of software, so license backward and forward compatibility is something to consider where applicable.

Subscription-based licensing, such as with cloud solutions Amazon Web Services or Microsoft Office 365, focuses primary on charging customers monthly or annually for the amount of cloud resources used. In the Microsoft Azure cloud, for example, you pay for Windows virtual machines only when they are running (there is a small cost associated with the storage of virtual machine disks in the cloud).

Per-user concurrent licensing applies to the number of users connected to a network server or service at any given time. A five-user license means up to five users can use the software at the same time. Once those users log out, new users can connect to the software up to a maximum of five at a time.

Other licensing options include those tied to a specific device often through a USB hardware key, otherwise called node-locked licenses because they are tied to a specific node. Signature-based licensing is often used with digital rights management (DRM) for gaming or the use of media files: the server issues a signed license, and the client device verifies the signature’s validity before adding the license to the device.

Installing a Type 1 Hypervisor

Most modern Type 1 hypervisors require 64-bit architecture as well as hardware virtualization support. If you’re using true server-class hardware, this won’t be an issue. If you’re testing the hypervisor using standard desktop hardware, you need to be extra careful.

Firmware updates (such as BIOS or the Unified Extensible Firmware Interface [UEFI]) may be required prior to installation, even for indirect reasons, such as network Preboot Execution Environment (PXE) boot, USB device boot support, and so on. If you plan on installing the hypervisor from a DVD or USB, you may also have to change the boot order configuration on your machine.

CAUTION   Before installing a hypervisor, do your homework and make sure you have supported hardware. Trying to cut corners here will take more time later down the road.

Installing a Server Operating System

Whether you want to end up with a physical or virtual server OS, there isn’t much difference in the actual OS installation itself.

Common server operating systems include

•   Microsoft Windows Server

•   Microsoft Windows Server Embedded (for purpose-specific hardware appliances)

•   UNIX variants such as BSD, AIX, and Solaris

•   Linux variants such as Red Hat, Ubuntu, and SUSE Linux

NOTE   Interestingly, the Apple macOS is loosely based on BSD UNIX. Of course, the macOS has plenty of APIs beyond BSD. If you like UNIX-style shells and scripts, you’ll feel right at home in the macOS at a terminal prompt.

Keep in mind that many modern OSs have just the bare minimum available with a default installation. You may have to install and enable additional services such as file sharing and web servers.

Server Installation

You can begin the server OS installation from a CD-ROM, a DVD, a USB device, or a shared folder over the network—one way or another, you need access to the installation files. Many on-premises and cloud environments use VM images to create new VMs, but there are many legitimate cases for which you’ll be installing the OS on physical hardware (often called a bare metal installation) and not a virtual machine. This chapter includes lab exercises that step through the installation of a Windows server and a Linux server in VMware Workstation Pro.

Server Installation from an Image

Server OS images may have been already created; in that case, you can apply the image to your new physical or virtual server instead of running the installer from the installation media. You can create and apply server OS images using tools such as these:

•   Ghost Solution Suite

•   Microsoft System Center Configuration Manager

•   Microsoft Deployment Toolkit

•   Microsoft DISM.exe command line tool

For example, we can capture a server OS image by booting from alternative media and using DISM:

In this example, we are capturing an image of c:\ and storing it on drive e:\ (presumably an external USB drive).

We can apply an image by booting from alternative media, including booting over the network, using the following:

dism /Apply-Image /Imagefile:e:\Images\win2019.wim /index:1 /ApplyDir:c:\

Because multiple images can be stored using the Windows Imaging Format (WIM), we specify the image with the /index parameter. WIM requires the disk to be partitioned and formatted prior to the application of an image.

Server Cloning

The previously mentioned install methods work on physical servers and also for creating virtual machines, but there are a few additional virtual machine options to consider.

You can clone a physical or virtual machine if you have the right tools. For example, VMware Workstation Pro has a built-in virtual machine cloning option that copies one virtual machine to a new one. This can be quicker than other installation methods if the new server should be very similar to the original virtual machine.

When cloning, you may be given the option to create a linked clone, which uses minimal disk space but is linked to the original virtual machine, or you can create a fully independent clone that uses more disk space but is not linked to the original virtual machine. Linked cloned virtual machine changes made after the clone is created are independent from the original virtual machine. Linked clones work well when you need multiple virtual machines using the same standard OS configuration initially.

Physical-to-virtual (P2V) cloning uses a physical server as the source but results in a virtual machine with the same settings. Some tools such as the VMware vCenter Converter utility require a P2V agent to be installed within the physical server OS to read settings.

Virtual Machine Deployment Templates

By using a server deployment template, you can partially or fully automate virtual server deployment. This is true for both on-premises machines and in the public cloud.

Virtual machine templates specify virtual hardware details, OS options, network settings, and so on. This facilitates and expedites the server provisioning process. You can use tools such as Microsoft System Center Virtual Machine Manager (VMM) or VMware vCenter in an on-premises environment to achieve this.

In the public cloud, a deployment template can, once again, partially or fully automate virtual server provisioning. Microsoft Azure uses Azure Resource Manager (ARM) templates to this effect, while in Amazon Web Services (AWS), this is referred to as a CloudFormation template. These types of templates can deploy not only virtual servers but any other type of cloud resource such as databases, web applications, load balancers, and so on.

Scripted Server Installations

Whether you are applying an image or installing from source media, you can also create an answer file to automate some or all of the OS installation. Red Hat Enterprise Linux 8, for example, uses Kickstart files to automate installations.

Automating a Windows server installation can be done with the unattend.xml file created using the Windows Systems Image Manager (SIM), which is a tool included with the Windows Assessment and Deployment Kit (Windows ADK). If you want the answer file read automatically when installing the Windows OS, name it autounattend.xml and place the file on the root of removable media such as a USB thumb drive.

Local vs. PXE

In addition to performing the server OS installation from local media (setup.exe for Windows server installations) or a locally stored image, you can also boot over the network from a PXE. Figure 3-11 shows a PXE boot screen. PXE booting enables OS installation from the installation files, or you can apply an OS image. Prior to installing the server OS from installation media, you can apply updates to the source installation files using a process known as slipstreaming.

Figure 3-11  PXE boot screen

PXE must be supported by the physical or virtual machine’s BIOS or UEFI settings and the NIC itself, and you need a PXE boot server listening on the network. Microsoft Remote Installation Services (RIS) and the newer Windows Deployment Services (WDS) provide this functionality, although there are many vendor solutions out there.

The great thing about PXE installation/imaging is that technicians don’t have to carry around storage devices containing installation files or OS images. The downside is that you’re pulling the OS down to the machine over the network, so network bandwidth use goes up.

PXE boot relies on DHCP to assign IP settings to PXE clients, and it also uses Trivial File Transfer Protocol (TFTP) to download a small boot image OS used for installation and imaging.

Installation Details

When you are actually installing a server OS, if it’s not an automated installation, you may be asked to supply the following:

•   Disk layout, including disk partitioning, file system formats, and swap file/partition

•   Server name

•   IP configuration settings

•   Administrative user credentials

•   Additional drivers for nonstandard hardware

•   Product key or subscription details used to activate the installation and receive updates

•   Additional software that should be installed

All of these items can be specified in the Windows unattend.xml and autounattend.xml files for scripted installations.

Server Administration Methods

A Windows Server 2019 installation does not have to have a GUI; this is called a Server Core installation, and it includes a command line environment. Modern Linux distributions support a GUI and offer the technician the option to install it during the installation process.

If you have physical access and the required management permissions to a server, you can manage it locally using command line or GUI tools. Some servers and network devices will allow local access through a local physical serial port where the technician could use a tool such as PuTTY to make a console connection through the port to issue commands.

Windows servers and clients with a GUI can use the Microsoft Management Console (MMC), which is a general tool that enables you to add snap-ins for specific management capabilities. For example, you might run mmc.exe and add the snap-in for Group Policy and certificate management.

You can use GUI tools installed on a client workstation to administer servers remotely over the network. In the case of Windows servers, administrators can download the Remote Server Administration Tools (RSAT) to accomplish this. In Figure 3-12, RSAT tools are being enabled on a client machine.

Figure 3-12  Enabling RSAT tools on a Windows client machine

KVM

Instead of having a separate display, keyboard, and mouse for each individual physical server, KVM (keyboard, video, mouse) switches connect the servers to a single display, keyboard, and mouse. You can switch to different servers to manage them locally.

Keyboards and mice have different interfaces; modern devices use USBs, but older input devices use PS/2 or serial connectors. For video, older displays use Video Graphics Array (VGA) connectors, while newer displays use High-Definition Multimedia Interface (HDMI) for both video and audio. Make sure your KVM solution matches the connectors for your devices, or you’ll have to buy adapters to get everything plugged in.

Out-of-Band Remote Administration

Physical and virtual servers must be accessible over the network for management purposes. Although there are plenty of software-based remote management solutions, hardware-based solutions provide more security and reliability. Out-of-band administration provides hardware-level remote access to a host without relying on the OS software running.

Web-Based Enterprise Management (WBEM) is a standardized way of managing and monitoring services and devices from different vendors. Of course, many vendors have their own proprietary management and monitoring tools.

The monitoring of server components such as CPU use, temperature, OS health, and so on, falls under the umbrella of lights-out management (LOM), a remote management solution supported by most vendors.

KVM over IP

These days, a KVM also works over IP (IP KVM or KVM over IP). This enables remote server access even over the Internet, and it can enable hardware-level (out-of-band) remote access if that is supported by your server hardware.

KVM-over-IP switches are hardware appliances with centralized management and auditing tools. For instance, a KVM can require its own authentication in addition to whatever is required by servers themselves.

Traditional software-based remote management solutions such as Virtual Network Computing (VNC), Remote Desktop Protocol (RDP), and Secure Shell (SSH) all depend on the OS function. But what if the system crashes? IP KVM can overcome this, but, again, physical servers must support this out-of-band type of hardware remote management. It also means TCP/IP settings must be configured at the hardware level to enable remote access across WANs.

IPMI

The Intelligent Platform Management Interface (IPMI) is a remote server management solution commonly used with various vendor blade enclosures. Management capabilities include remote power on and power off and disk access, all through out-of-band management. IPMI also provides server monitoring and inventory functionality.

A baseboard management controller (BMC) is the interface between server management tools and the physical server hardware being managed. Server administrators can connect to IPMI management systems locally or over a network.

iLO and iDRAC

Hewlett-Packard’s out-of-band solution is Integrated Lights Out (iLO) management. The iLO solution offers not only secure remote management capabilities, including remote power on and power off, but it also includes server monitoring and alert capabilities.

For hardware-based out-of-band management, Dell servers support Integrated Dell Remote Access (iDRAC). Administrators can connect to remote servers at the hardware level, even using a friendly web browser interface from which a virtual server console can be accessed, which enables remote power on, power off, and access to server storage media. The virtual media option enables administrators to configure the physical server to use media on the technician’s remote administration station for installing software and applying updates.

In-Band Remote Administration

In-band remote management relies on software running within the OS. If the OS hangs, remote management of this type no longer works. Although each OS has its own remote management solutions, you can also use the cross-platform VNC remote control tool.

Many tools use the Simple Network Management Protocol (SNMP) to query management information bases (MIBs) on devices. MIBs are used to gather inventory and statistic data about network devices.

SSH

SSH has long been the standard and secure way of remotely managing not only UNIX and Linux hosts but also network devices such as switches and routers. It supersedes the insecure Telnet protocol, which sends credentials in plaintext.

SSH needs a server-side listener for clients to be able to connect; the standard listening port is TCP 22. Although SSH is normally used for command line remote management, X-forwarding can be enabled within SSH to redirect graphical UNIX and Linux applications to show up on the client computer. In other words, you can interact with UNIX and Linux GUI apps on your Windows client station.

Besides the standard username and password authentication, SSH can also use public-key authentication. An administrator’s public key is stored on the SSH host, and the mathematically related private key is stored on the administrator’s workstation. The keys are used to authenticate the admin to the SSH host.

You can download and configure a free PuTTY tool to make SSH connections to network devices including UNIX and Linux hosts from within a Windows environment, as shown in Figure 3-13.

Figure 3-13  Configuring PuTTY for SSH remote administration

RDP

Windows hosts normally use the Remote Desktop Protocol (RDP) for remote management of both Windows clients and servers. RDP listens on UDP and TCP port 3389 by default.

Newer versions of the Windows Server OSs support Network Level Authentication (NLA) for RDP sessions. NLA improves on older versions of RDP in the following ways:

•   Entering the username and password uses client resources, not server resources.

•   RDP sessions are encrypted with an SSL certificate.

Figure 3-14 shows how RDP gives admins the ability to access a Windows server remotely to run GUI management tools—but what if the server is installed as Server Core? Server Core is a Windows server option that does not include the GUI. When admins RDP into Server Core, they simply get a command prompt.

Figure 3-14  Connecting to a Windows host using RDP for remote management

WinRM and PowerShell

Windows admins can also use PowerShell to manage Windows servers remotely at the command line. PowerShell depends on the Windows Remote Management (WinRM) service to be configured, to run, and to be accessible through firewalls. Newer versions of WinRM use TCP ports 5985 and 5986 for unencrypted and encrypted connections, respectively.

Outside of PowerShell, you can use the Windows winrs command to execute commands remotely on a Windows host, but you need to ensure that WinRM has been enabled. This can be done via a Group Policy or by using the winrm qc command. You could use winrs with -r to specify the remote host as follows:

Winrs /r:Server1 dir c:\

This example will list items on c:\ on Server1.

Consider the three PowerShell remote management examples in Table 3-5.

Table 3-5  PowerShell Remote Management Examples

Additionally, PowerShell Desired State Configuration (DSC) enables administrators to configure and manage Windows and Linux hosts centrally using a declarative syntax, as shown in the following example:

This would be placed in a PowerShell script. It ensures that the Windows IIS web server is installed, and if not, it will be. PowerShell DSC can even be used to manage cloud virtual machines.

Automating Server Administration with Scripting

Scripting provides a method of automating server administration by placing commands in one or more script files and then invoking the script file or having the script invoked automatically during the machine bootstrap process. Scripts can automate just about anything, such as server or service startup, shutdown, logging in to remote hosts, and user account management. There are four widely used script types, listed in Table 3-6.

Table 3-6  Common Mail Protocols

Scripts can reference environment variables, such as the currently logged on username. When you’re reading and writing variables in PowerShell, the variable name must be prefixed with a dollar sign ($). You can also set the data type of a variable, such as an integer, a string value, an array, or a date time value. Data types vary depending on the type of scripting language being used. Consider the following PowerShell examples with their descriptive comments:

You can execute script commands repetitively in a loop until a certain condition is met. There are various looping constructs, including a while loop, which executes until a condition is met, and a for loop, which is normally used when you know how many times the loop should execute. The following PowerShell example uses a for loop to display city names stored in the array variable $cities:

ForEach ($city in $cities){$city}

Server Documentation

If you’ve ever done IT consulting, you know that accurate and readily available documentation saves everybody time and money. Troubleshooting a server that isn’t performing well takes much longer when you know nothing about how the server is configured. Vendor service manuals are a great troubleshooting starting point when it comes to hardware misconfigurations.

Each server needs documentation and a change log, and, ideally, this is all automated and inventoried in a database somewhere that is easily searched. Aside from OEM hardware and software service manuals, we need to know how these technological solutions have been put in place in a specific environment. How companies implement technology is sensitive information. This is a big part of reconnaissance when malicious users try to learn about a network to identify vulnerabilities. That’s why it’s important to keep this documentation under lock and key, and encrypt any files containing this stuff.

Asset Life Cycle

On-premises servers, and even cloud servers running critical IT systems, are assets in the sense that we must apply a risk-management framework to them to protect them throughout their useful life. Here’s an example of a server life cycle:

1.   Provision servers and their IT workloads.

•   Procurement of servers on-premises or the cloud

2.   Configure servers and their IT workloads.

•   Manually or automatic

3.   Manage servers and their IT workloads.

•   Security

•   Patching

•   Compliance with laws/regulations

•   Change management policy and forms

4.   Monitor servers and their IT workloads.

•   Ensure peak performance

•   Provide centralized monitoring and logging

5.   Decommission servers when they have reached end of life.

•   Proper disposal techniques

•   Physical destruction

•   Sanitize/wipe media

6.   Upgrade or functionally replace IT workloads.

Asset Inventory

Until the 1990s, very few automated asset inventory options were available for IT environments. Long were the days spent crouching under desks and behind server racks to inventory equipment physically and to document configuration settings.

These days, all of this can be automated and is readily accessible for small, medium-sized, and large enterprises. Even so, physical equipment still needs to be labeled or inscribed for tracking purposes. Inventorying servers falls into two categories: hardware and software.

Hardware Inventory

We can’t troubleshoot, optimize, or upgrade something if we don’t know what we have to begin with—we have no reference point! Even virtual machines have “virtual hardware.” This can be very useful when you’re optimizing and troubleshooting, both of which are covered later in the book.

Server items that may be inventoried include the following:

•   Make, model, and serial number

•   Whether the physical server is owned or leased

•   Motherboard and device serial numbers

•   Physical or digital asset tag (on a sticker or stored in the BIOS)

•   RAM

•   Storage

•   Network interfaces

•   Other peripherals

•   Printers

•   USB devices other than storage

•   Monitor displays

Here are some reasons for creating a detailed and accurate hardware inventory:

•   Inventory audits

•   Asset tracking

•   Determine asset use

•   Asset repair and warranty

•   Asset recall

•   Asset security

Solutions provided by Spiceworks, Altiris, or Microsoft System Center Configuration Manager (SCCM) (see Figure 3-15), for example, provide ways to inventory devices on a large scale, such as in a data center. Inventory solutions may or may not have a software agent running within the OS; more detail is available when an agent is used, since it knows everything about that specific server. Inventory scanning schedules determine whether inventory data is up-to-date. Running queries or reports against inventory data stored in a database makes managing server assets easier.

Figure 3-15  SCCM hardware inventory for a Windows computer

In a data center with thousands of pieces of IT equipment, inventorying and monitoring are easier when radiofrequency identification (RFID) tags are used. RFID mobile reading devices scan items with RFID tags in close proximity—so, for instance, rack-mounted servers could have RFID tags adhered to the front of the servers for ease in scanning.

Software Inventory

Knowing the specific versions of operating systems, drivers, and application software in use is critical. Let’s say, for example, that a software vendor has released a critical security update that needs to be applied immediately. If you don’t know how many servers are running the affected software, you can’t even determine the scope of the work required! Software license compliance is also important; licenses can be inventoried and you can reconcile this against purchased licenses (this is called a true up).

Similar to hardware inventory, software inventory can and should be automated on a scheduled basis. Using the same type of enterprise tools used for hardware inventory (Spiceworks, Altiris, and SCCM, to name a few) allows for automation. You can then run queries and reports against inventoried software. As another example, you may want to know how many instances of a version of a certain server OS are running on your network to ensure license compliance, or you may want to know how many devices do not have the required configuration to support an application, in which case new hardware may need to be procured.

Service Level Agreements

A service level agreement (SLA) is a contract outlining expected service from a service provider to a service consumer. This could exist between your company and a public cloud provider, or you might use SLAs within an organization between business units and the services offered by the IT department. When things go wrong, the SLA can be very valuable.

The two most common items found in SLAs are

•   Uptime

•   This specifies expected availability for IT services.

•   Providers are usually obligated to notify clients of scheduled maintenance and downtime.

•   Response time

•   This specifies how quickly IT services respond when they are needed.

•   This can also specify how quickly the provider responds when you need support.

•   How long will it take for a problem to be resolved?

•   Is support available only during business hours?

When providers fail to meet SLA expectations, they may offer credits of some kind, and you should determine whether there is a maximum number associated with this. It’s a good idea to ensure that the SLA includes a clause for leaving a provider if it chronically fails to meet thresholds documented in the SLA.

All of the responsibility, however, isn’t just on the provider. As an IT service consumer, you may have to adhere to certain rules, such as how servers are configured and used and which updates and software components are allowed on servers.

Other Documentation

Documentation goes beyond just servers. Servers live in a technological ecosystem that affects them, so there are other factors to consider:

•   Network infrastructure diagrams  Server placement

•   Workflow, dataflow, and application architecture diagrams  Server involvement in data movement, processing, and storage

•   Baseline documentation  Normal operating conditions and troubleshooting, including required patches (see Chapter 7)

•   Recovery documentation  Policies and procedures to return the server to an operational state as quickly as possible (see Chapter 8)

Much can be learned about server and IT workload configurations by checking log files. Most UNIX and Linux variants store log files in the /var directory. Windows logs are accessible using the GUI event viewer tool or PowerShell cmdlets such as Get-eventlog.

If Group Policy is used heavily in your environment, it can be helpful to get a complete report of all Group Policy Objects (GPOs) and their settings. One quick way of achieving this is as follows:

Get-gporeport -all -reporttype html c:\gpo_report.html

This example retrieves all GPO settings linked to all AD organizational units (OUs) and puts them into a nicely formatted HTML document.

Maintaining Servers

With inventory in place, server maintenance becomes easier through automated inventory and documentation. Proactive management also includes ensuring that firmware and software patches are delivered in a timely fashion. Then we need reports that can confirm that patches have been successfully applied. Of course, we’ll also know all of this because of frequent software inventory scans on our servers.

Patch Management

UNIX and Linux variants sometimes require a subscription before updates can be applied, just like Windows Server OSs require activation before all updates are available.

There are different types of updates. Some are critical security updates that must be applied right away, while others add additional functionality to software. This also holds true for firmware updates for motherboard BIOS/UEFI, printer firmware, router firmware, and so on.

Imagine a data center with 1000 hypervisor operating systems, which, of course, will need updates on a continuous basis. Instead of each of those 1000 systems downloading the same updates, we can configure centralized update management and then run reports on update compliance.

Windows Server Update Services (WSUS) is a free Microsoft patch-management tool that has been available for years. Microsoft SCCM uses WSUS to manage and deploy patches using the SSCM infrastructure. Updated metadata is synchronized from either Microsoft update servers online or from another WSUS server. Updates can be applied manually or on a scheduled basis to a group of computers.

Deploying and managing non-Microsoft updates in a Windows environment can be done using tools such as Microsoft System Center Updates Publisher (SCUP) or other vendor-specific solutions.

NOTE   It’s wise to test updates in a controlled environment before pushing them out to production machines; sometimes updates cause problems.

Proactive Maintenance

At this point, you know that hardware and software inventory, patching, and various types of documentation can help ease server management over time, but there are other factors to consider as well.

Sometimes the simplest physical issues can make a big difference with IT computing. Servers need to be kept clear of dust, with no obstructions near intake fans. And they must be kept cool; overheating servers could cause performance degradation (CPU throttling to slow down speed, which reduces heat), or worse—server power-downs.

Speaking of server power-downs, servers should be plugged into uninterruptible power supplies (UPSs) to ensure the graceful shutdown of servers when the power goes out. You’ll find more about UPSs in Chapter 8.

Reactive Maintenance

Despite the best-laid proactive plans, sometimes we have to react quickly to certain events when managing servers. Chapter 8 provides details, but there are a few everyday things you should keep in mind:

•   LED indicators on equipment such as servers, UPS systems, and storage arrays

•   Indicates problems as well as normal status messages

•   Failing disk arrays, RAM errors, problems with batteries or backplanes, and so on

•   Error and beep codes

•   Vendor equipment with specific error and beep codes

•   Warning of some kind, such as imminent drive failure

Hands-on Exercises

Exercise 3-1: Install the Microsoft Windows Server 2019 Operating System

1.   Start VMware Workstation Pro and ensure that the Srv2019-1 virtual machine you created in Chapter 2 is open.

2.   In the navigation panel on the left, click Edit Virtual Machine Settings. On the left side of the screen, notice that the Network Adapter is configured for NAT. This enables the virtual machine to communicate on your network (and potentially the Internet if you have an Internet connection) while using its own unique IP addressing scheme.

3.   Click CD/DVD, and then, on the right, click Use ISO Image File. Click Browse and select the Windows Server 2019 Trial ISO File Downloaded, as per the instructions in Appendix A, and click Open. Within Device Status, check the Connect At Power On option if not already enabled. Click OK.

4.   In the navigation panel on the left, click Power On This Virtual Machine, click in the virtual machine screen, and press ENTER when presented with the Press Any Key To Boot From CD Or DVD message.

5.   In the Windows Setup dialog box, accept the defaults and click Next.

6.   Click Install Now.

7.   From the list of operating systems to install, choose the second option, Windows Server 2019 Standard Evaluation (Desktop Experience), and then click Next.

8.   Accept the license terms and click Next.

9.   On the installation type screen, in the Which Type Of Installation Do You Want? dialog, choose Custom: Install Windows Only (Advanced).

10.   You will then see the four virtual hard disks you created in Chapter 2 in Exercise 2-2. Ensure that Disk 0 Unallocated Space is selected, and then click Next.

11.   Windows begins copying files. This is a good time to get a cup of coffee, but be quick! Depending on your machine, this part of the install may take only 2 or 3 minutes.

12.   The installation will reboot your virtual machine automatically and continue the installation. You will be prompted to specify the administrator password. Enter Pa$$w0rd172hfX and click Finish. For production environments, always adhere to organizational security policies related to the use of strong passwords. This password is used only for testing purposes.

13.   After a moment the server login screen is displayed. From the VMware VM menu, choose Send Ctrl+Alt+Del and enter the Administrator password, Pa$$w0rd172hfX. Then press ENTER. The server desktop is displayed and the Server Manager tool automatically launches. If you get a network message about finding PCs, devices, and so on, click Yes. If you get a message stating to Try Managing Servers With Windows Admin Center, check the box next to Don’t Show This Message Again and then click the X to close the dialog box.

14.   Configure Server Manager not to start automatically: In Server Manager, choose Manage | Server Manager Properties. Check the box that says Do Not Start Server Manager Automatically At Logon. Click OK, and then close Server Manager.

Add a second network adapter for the server

15.   From the VMware VM menu, choose Settings.

16.   Click Add at the bottom of the screen, choose Network Adapter, and then click Finish.

17.   Choose Custom: Specific Virtual Network and choose VMnet5 from the drop-down list. Click OK. If prompted with hints, turn them off and continue. Your virtual machine screen may be blank for a few seconds as the change is put into effect.

Configure a static IP4 address for the server

18.   If you can’t see the Windows Start menu icon at the bottom left of the screen, from the VMware View menu, choose Stretch Guest, and then choose Keep Aspect Ratio Stretch. Or, from the Start menu, select Control Panel, and then select Network And Internet. Click Network And Sharing Center.

19.   On the left, click Change Adapter Settings. Right-click the Ethernet0 adapter and choose Rename. Type ExternalNAT and then press ENTER.

20.   Right-click the Ethernet1 adapter and choose Rename. Type Internal and then press ENTER.

21.   Right-click the Internal adapter and choose Properties. Select Internet Protocol Version 4 (TCP/IPv4), and then click the Properties button.

22.   Choose Use The Following IP Address and enter the following values:

IP address: 192.168.1.200

Subnet mask: 255.255.255.0

23.   Click OK and then click Close.

24.   Click the Start menu and type cmd and press ENTER.

25.   Enlarge the command prompt window, and then type ipconfig and press ENTER. Notice the IP address information listed for the Internal and ExternalNAT network adapters.

Name the server

26.   From the Start menu, choose Server Manager.

27.   On the left, click Local Server; on the right, click the blue computer name link, and then click the Change button.

28.   For the computer name, type Srv2019-1 and click OK.

29.   At the You Must Restart Your Computer To Apply These Changes prompt, click OK, and then click Close. Choose Restart Now. The server will restart.

Create a snapshot of the installation after the computer has restarted in case you need to revert to this configuration in the future

30.   From the VMware VM menu, choose Snapshot, Take Snapshot.

31.   Type Fresh Installation for the name, and then click Take Snapshot. You may have to wait a few minutes as the snapshot is created. You can track the snapshot creation progress at the bottom left of the VMware Workstation window; it will say “Saving state…” followed by the percent complete.

Create a second virtual machine by cloning the one you just created

32.   Shut down your Srv2019-1 virtual machine: from the VM menu, choose Power, and then choose Shut Down Guest.

33.   From the VM menu, choose Manage, Clone. Click Next twice.

34.   On the Clone Type screen, choose Create A Full Clone. Click Next.

35.   Name the clone Srv2019-2 and choose a location on your computer that has plenty of free disk space. Click Finish and then close the dialog box when cloning has completed.

36.   Start the Srv2019-1 virtual machine. Switch to the Srv2019-1 tab, and on the left, click Power On This Virtual Machine.

37.   Switch to the Srv2019-2 tab, and from the VM menu, choose Settings. Remove the Network Adapter configured with NAT. Click OK and then start the virtual machine.

38.   Log in to Srv2019-2 as Administrator with a password of Pa$$w0rd172hfX and change the following:

•   In Control Panel, configure IPv4 to obtain the IP address and DNS server address automatically for the Internal network interface.

•   Change the computer name by entering Srv2019-2 using Server Manager.

39.   When prompted, restart Srv2019-2.

40.   After Srv2019-2 has restarted, from the VM menu, choose Snapshot, Take Snapshot. Type Fresh Installation – Server2 for the name and then click Take Snapshot. You may have to wait a few minutes as the snapshot is created.

Exercise 3-2: Install the DNS Server Role in Windows Server 2019

1.   Make sure you are logged into your Srv2019-1 virtual machine as the Administrator account with a password of Pa$$w0rd172hfX.

2.   Start Windows PowerShell from the Start menu and enter the following command:

install-windowsfeature dns -includemanagementtools

(Note that there should be no space between the – symbol and the includemanagementtools parameter.)

3.   After the DNS server role is installed, enter the command

get-windowsfeature *dns*

to ensure that it shows up as being installed (with an X in the box). The asterisks are wildcard symbols that will show any features containing the text dns.

4.   Configure the internal server network interface to use itself for DNS name resolution by entering the following command:

set-dnsclientserveraddress -interfacealias internal -serveraddress 127.0.0.1

(Note that there should be no space between the – symbol and the serveraddress parameter.)

5.   Configure the external server network interface to use itself for DNS name resolution by entering the following command:

set-dnsclientserveraddress -interfacealias externalnat -serveraddress 127.0.0.1

6.   Type ipconfig /all to verify that the DNS server being used by the interfaces is 127.0.0.1, as shown in the following illustration.

7.   Verify DNS functionality by typing nslookup and pressing ENTER. Type www.google.com and press ENTER. You should see a list of IP addresses that service google.com. Press ENTER. Type exit and press ENTER to close the PowerShell window.

Exercise 3-3: Configure the DNS Server in Windows Server 2019

1.   Make sure you are logged into your Srv2019-1 virtual machine with the Administrator account.

2.   Click the Start menu and type DNS in the search bar. When the DNS tool is displayed, press ENTER.

3.   In the left navigator of the DNS Manager window, expand your server name, highlight Forward Lookup Zones, and right-click Forward Lookup Zones. Choose New Zone.

4.   In the Welcome To The New Zone Wizard, click Next.

5.   Accept the default of a Primary Zone, and then click Next.

6.   For the Zone name, type fakezone.com and then click Next.

7.   Accept the defaults for the rest of the wizard and click Finish.

8.   Expand Forward Lookup Zones and click fakezone.com. On the right, notice the default SOA and NS DNS records.

9.   A reverse lookup zone should be created for the subnet. On the left, highlight Reverse Lookup Zones, and then right-click Reverse Lookup Zones and choose New Zone. Click Next.

10.   Continue through the wizard. Create a Primary IPv4 Reverse Lookup Zone. For the Network ID, type 192.168.1. Accept the defaults for the rest of the wizard and click Finish.

11.   Right-click fakezone.com and choose New Host (A or AAAA record).

12.   In the New Host window, specify www for the name, and for the IP enter 192.168.1.200. Enable the option Create Associated Pointer (PTR) Record. Click Add Host and then click OK. If the New Host window pops up, click its close box. Click Done.

13.   Select fakezone.com on the left, and notice the new A record for www.fakezone.com.

14.   Start PowerShell. Type nslookup and press ENTER. Type www.fakezone.com, and press ENTER. You should see the Address (192.168.1.200) returned for the host.

15.   Type set type=ptr and press ENTER. Watch for the case and spacing; it’s very unforgiving!

16.   Type 192.168.1.200 and press ENTER. It should return the name of www.fakezone.com—this comes from your reverse lookup zone.

17.   Type exit and press ENTER.

18.   Type get-dnsserver. PowerShell will then return info about the DNS server, including the zones. Keep PowerShell open for the next exercise. Close the DNS Manager window.

Exercise 3-4: Install an Active Directory Server in Windows Server 2019

1.   Make sure you are logged into your Srv2019-1 virtual machine with the Administrator account.

2.   In PowerShell type the following command:

install-windowsfeature ad-domain-services –includemanagementtools

3.   Start the Server Manager GUI tool.

4.   Click the flag notification icon in the upper right; you will see a message stating that you must Promote This Server To A Domain Controller. Click the link.

5.   Choose Add A New Forest, and within the Deployment Configuration window and for the Root Domain Name, type fakedomain.local. Then click Next.

6.   Enter Pa$$w0rd172hfX for the DSRM password and click Next.

7.   Accept the defaults for the remainder of the wizard and then click Install. After a few minutes, your server will restart.

8.   Log back in using the Fakedomain\Administrator account with a password of Pa$$w0rd172hfX.

9.   Click the Start button and type Active in the search bar. When Active Directory Users And Computers is displayed, click it. The fakedomain.local AD domain now exists.

10.   Click the Start button and type DNS in the search bar. When the DNS tool is displayed, click it.

11.   In the DNS Manager window, expand the server name on the left, and then expand Forward Lookup Zones. Notice the fakedomain.local zone.

12.   Expand fakedomain.local, and then click _tcp. Notice the four service location records for the domain controller.

13.   Start PowerShell from the taskbar and type get-aduser -filter* to verify that AD is accessible via PowerShell. You will see a list of AD user accounts. Close all open windows.

NOTE   These exercise instructions use a hybrid of command line interface (CLI) and GUI tools. The idea is to get used to using both.

Exercise 3-5: Install the DHCP Server in Windows Server 2019

1.   Make sure you are logged into your Srv2019-1 virtual machine with the Administrator account.

2.   Start PowerShell from Start menu and type the following:

install-windowsfeature dhcp –includemanagementtools

3.   Start Server Manager. Click the flag icon in the upper right. Click Complete DHCP Configuration, click Next, then click Commit, and finally click Close.

4.   In PowerShell, type restart-service dhcpserver.

5.   Click the Start button and type DHCP in the search bar. When the DHCP tool is displayed, click it.

6.   In the left navigator in the DHCP Manager window, expand srv2019-1
.fakedomain.local, select IPv4, right-click IPv4, and choose New Scope. Click Next. If you don’t see the server name immediately, close the DHCP tool and start it again until you do.

7.   For the name, type LabScope1 and then click Next.

8.   For the starting IP address, enter 192.168.1.50, and for the ending IP address, enter 192.168.1.80. Click Next four times.

9.   For the router (default gateway), enter 192.168.1.200 and click Add. Click Next.

10.   Click Next three times, and then click Finish.

11.   On the Srv2019-2 virtual machine, type the following command and then press ENTER.

ipconfig /release, then ipconfig /renew

12.   On Srv2019-1, in the DHCP tool, expand IPv4 and then expand Scope [192.168.1.0] LabScope1. Click Address Leases. You will see that an IP address has been leased to Srv2019-2.

Exercise 3-6: Install the Ubuntu Linux 20.04.1 Operating System

1.   Start VMware Workstation Pro and ensure that the Ubuntu-1 virtual machine is selected.

2.   In the navigation panel on the left, click Edit Virtual Machine Settings.

3.   Notice the Network Adapter on the left. Ensure it is set to use NAT.

4.   On the left, click CD/DVD, and on the right, click Use ISO Image File. Click Browse and select the Ubuntu Linux trial ISO file downloaded as per the instructions in Appendix A of this book. Click OK.

5.   In the navigation panel on the left, click Power On This Virtual Machine. The virtual machine begins booting from the Linux installation media.

6.   From the Ubuntu Linux 20.04.1 Welcome screen, press ENTER to select English.

7.   Press ENTER and accept default settings until you reach the Guided Storage Configuration screen. Press TAB until Done is highlighted, and then press ENTER. On the Storage Configuration screen, press ENTER.

8.   When prompted to Confirm Destructive Action, press TAB until Continue is highlighted, then press ENTER.

9.   Type user one in the Your Name field. Press TAB and then type ubuntu-1 in the Your Server’s Name field. Press TAB and then type uone in the Pick A Username field. Specify and confirm a password of Pa$$w0rd172hfX.

10.   Press TAB to highlight Done, then press ENTER. Press the SPACEBAR to enable the Install OpenSSH Server option, then press TAB twice to highlight Done, and then press ENTER.

11.   If you receive an option for Feature Server Snaps, continue by selecting Done.

12.   Once installation is complete, from the VM menu, choose Settings. On the left click CD/DVD (SATA). On the right, uncheck Connect At Power On. Click OK. Ensure that Reboot is highlighted and press ENTER.

13.   After the server reboots, click in the virtual machine screen and press ENTER when you see the Reached Target Cloud-init Target status message.

14.   At the Ubuntu1 login prompt, type uone and press ENTER. Type Pa$$w0rd172hfX and press ENTER.

15.   Type ip a to view the IPv4 address acquired through DHCP.

16.   On Srv2019-1, allow all incoming network traffic from Ubuntu1, and in a command prompt window type the following:

netsh advfirewall firewall add rule name="Allow all traffic from Linux" dir=in action=allow protocol=any remoteip=IP Of Ubuntu1

(Replace IP Of Ubuntu1 with the IP address from step 15.)

17.   Create a snapshot of the installation in case you need to revert to this configuration in the future: From the VMware VM menu, choose Snapshot, Take Snapshot. Type Fresh Installation for the name, and then click Take Snapshot. You may have to wait a few minutes as the snapshot is created.

18.   Shut down each virtual machine guest by switching to the Virtual Machine tab and choosing VM, Power, Shut Down Guest.

NOTE   Throughout this book, you will learn about not only Windows Server OS but also about the Ubuntu Linux OS. This includes hands-on exercises and troubleshooting tips.

Chapter Review

This chapter focused on how to install, configure, manage, and maintain server operating systems, whether they run on physical hardware or within virtual machines.

Server Roles

The type of workload handled by a server must be planned before server installation, and in some cases, these roles can be co-located on the same server.

DHCP

On DHCP servers, centrally configured IPv4 and IPv6 settings can be deployed to DHCP. DHCP servers use UDP port 67, and DHCP clients use UDP port 68. DHCP scopes contain IP address ranges as well as additional settings such as lease duration, default gateways, DNS servers, reservations, exclusions, and more. Specific DHCP settings can be delivered to certain types of DHCP clients using vendor class identifiers. IPv4 clients that cannot reach DHCP will be auto-configured with an APIPA address with a prefix of 169.254.

Name Resolution

DNS servers are queried by clients on UDP port 53 primarily for name resolution, where an FQDN is supplied and a corresponding IP address is returned. Given an IP address, a DNS server can also perform a reverse lookup to return a name. DNS is a hierarchy of domains, where different DNS servers control different parts of the DNS namespace. The most common type of DNS resource record managed by administrators is an A record (IPv4) that is used for resolving names to IP addresses; the equivalent for IPv6 is an AAAA record.

WINS is used for resolving computer names to IP addresses, but, unlike DNS, it is not a hierarchy, but rather a flat list of NetBIOS computer names.

NTP

NTP is used to synchronize time for network devices from a time source. Connectivity for this protocol occurs over UDP port 123. Stratum 0 NTP devices are a trusted time source. Stratum 1 devices are NTP servers that get their time from a Stratum 0 device. Stratum 2 devices are NTP servers that get their time from Stratum 1 servers, and so on.

Directory Services

A directory service is a network database containing network-related objects such as users, computers, and groups. Often this is replicated among multiple servers to provide high availability and service localization.

Microsoft Active Directory uses domain controllers to house and replicate the directory service database. Clients discover domain controllers via DNS service location records.

Other Server Roles

Web servers use HTTP to transmit HTML web pages to web browser clients. Clients request the pages over TCP port 80 (HTTP) or 443 (HTTPS) and the server responds to the client on a dynamically allocated client port number normally between 49152 and 65535. HTTPS requires a server-side SSL/TLS certificate to secure the connection. Web site developers can build server-side/client-side code for site functionality. Enterprise Web SSO uses an underlying directory service, often in the form of identity federation.

Application servers can consist of multiple components such as a front-end web server and a back-end database that serve a specific business purpose.

File and print servers enable connectivity to these resources over the network and must have properly configured ACLs to allow access. SMTP mail servers transfer mail between SMTP mail hosts; POP and IMAP are message retrieval protocols used by mail client software. IMAP allows synchronization between different devices, unlike POP.

Routing and remote access servers (RRAS) have at least two network interfaces and can be configured for IP routing, NAT, or VPNs.

Virtualization Servers

Hypervisors are software that run virtual machines and manage access to physical hardware. Type 1 hypervisors have direct access to physical hardware; Type 2 hypervisors rely on an underlying operating system to manage hardware access.

Hardware for the hypervisor must be planned relative to the virtual machines and their workloads that it will host. More RAM would be needed to run multiple virtual machines, and some IT workloads such as large database servers will require more resources such as RAM.

Guests are virtual machines running on a hypervisor host, and each is configured with its own set of virtual hardware to accommodate its IT workloads properly. Settings such as dynamic memory can more efficiently use host memory among multiple virtual machines.

Server Installation

Hardware and software compatibility lists must be consulted before installing servers to ensure the smooth installation and running of IT services. Server OSs can be installed from bootable media or over the network, including PXE boot. PXE booting occurs over the network without local media, and services such as Microsoft RIS/WDS provide this functionality.

Server OS images can be used as well, and a server installation from media or an image can be completely automated using answer files or enterprise deployment solutions. A virtual machine deployed on-premises or in the cloud can use virtual machine images (or templates), which enable easy server deployment in mere minutes.

Existing physical servers can use a software agent to read configuration settings, which results in a virtual server through a process called physical-to-virtual (P2V) cloning. Existing virtual machines can be cloned when new virtual machine requirements are similar to the original source server configuration. Virtual machine templates can be used on-premises or in the cloud to provision virtual machines quickly.

Open-source software does not normally incur licensing fees, but technical support does. For proprietary software, there are numerous licensing models such as per-server, per-instance, per-core, per-socket, and per-concurrent user. Node-locked licensing is tied to a specific node. Signature-based licensing is based on digital signatures and is commonly used to verify the authenticity of a gaming or media provider.

Server Administration Methods

Server administration methods include the following:

•   Locally at the console

•   Remotely using GUI tools such as Microsoft RSAT or RDP

•   Remotely using SSH

•   Remotely using PowerShell or WinRM

KVM is used to connect to numerous servers where a single keyboard, video display, and mouse is used. KVM enables technicians to switch to different servers for management, whether servers have physical connections to KVM or over IP.

Out-of-band administration provides hardware-level remote access to a host without relying on the OS software running. Common solutions include Dell’s iDRAC and HP’s iLO; the server hardware must support this type of remote administration, and it must be configured with IP settings.

Server technicians can create Bash (.SH), batch (.BAT), Visual Basic (.VBS), or PowerShell (.PS1) scripts to automate server management tasks such as software installation, server or service startup or shutdown, user account management, and more. Data types, variables, and looping construct details and syntax vary slightly across the scripting types.

Server Documentation

Server documentation includes the following:

•   OEM service manuals

•   Hardware and software inventory

•   Log files

•   Network/dataflow diagrams

•   Service level agreements

•   Baseline documentation

•   Recovery documentation

The server asset life cycle, from procurement to disposal, must be documented, including configuration changes during the useful life of the server. This data can be crucial for recovery services and should be made highly available through backups or replication to alternate locations. Server configuration documentation must also be kept secure—the last thing you want is malicious users knowing server configuration details.

Server Maintenance

Proactive maintenance includes applying firmware and software updates, ensuring that server room and data center environmental controls are in place, plugging servers into UPS systems, and making sure that a recovery procedure exists in the event of server failure.

Patch management can be centralized and automated using a tool such as WSUS or SSCM for Windows environments. Reports can be run to ensure that updates have been successfully applied.

Reactive maintenance involves viewing log entries, responding to alerts including error codes, server LCD messages, and so on.

Questions

1.   Through which methods can on-premises servers communicate with cloud-based virtual machine servers? Choose two.

A.   Site-to-site VPN connection

B.   IPv6 leased connection

C.   Dedicated leased connection

D.   PKI

2.   Which server role provides centralized IP configuration settings for clients?

A.   DNS

B.   IIS

C.   RDP

D.   DHCP

3.   You need to configure DHCP to deliver a specific IP address to a specific network printer. What should you configure?

A.   DHCP scope

B.   DHCP reservation

C.   Default gateway

D.   PXE

4.   Your network consists of Windows 10 computers and Android smartphones. You need to ensure that the Android devices are given IP addresses that place them on their own isolated VLAN. What should you do?

A.   Configure a DHCP vendor class identifier.

B.   Plug the Android devices into switch ports grouped into a VLAN.

C.   Configure a DHCP reservation.

D.   Configure a DHCP scope.

5.   Your users report that they cannot access Internet resources today, although yesterday this worked fine. At a user station, you notice the IP address begins with 169.254. Why can’t user stations reach the Internet?

A.   A DHCP server cannot be reached.

B.   An incorrect subnet mask has been specified.

C.   An incorrect default gateway has been specified.

D.   An incorrect DNS server has been specified.

6.   Which Windows command shows DHCP lease information?

A.   ipconfig /release

B.   arp -a

C.   nslookup

D.   ipconfig /all

7.   What type of DNS record is used to resolve FQDNs to IP addresses?

A.   MX

B.   PTR

C.   A

D.   AAAA

8.   Which port does a DNS server listen on for client queries?

A.   UDP 53

B.   TCP 53

C.   UDP 3389

D.   TCP 3389

9.   You install a Windows DNS server named DNS1. Clients on the network are configured to use DNS1 for name resolution. Users report they are able to connect to Internet resources by name. You need to ensure that DNS resolves only internal names. What should you do?

A.   Remove the DNS server default forwarders.

B.   Remove the DNS server default stub zones.

C.   Add DNS server root hints.

D.   Remove the DNS server root hints.

10.   You need to configure firewall ACLs to allow DNS server zone transfer traffic. Which port should your ACL allow?

A.   UDP 53

B.   TCP 53

C.   UDP 80

D.   TCP 80

11.   How do WINS and DNS differ?

A.   WINS uses a hierarchical naming structure; DNS uses a flat naming structure.

B.   WINS uses a flat naming structure; DNS uses a hierarchical naming structure.

C.   WINS uses AAAA records for IPv6; DNS uses A records for IPv6.

D.   WINS uses UDP port 53 for client queries; DNS uses TCP port 53 for client queries.

12.   Your network servers point to NTP time servers connected to reference clocks. Which type of NTP time servers do you have on your network?

A.   Stratum 0

B.   Stratum 1

C.   Stratum 2

D.   Stratum 3

13.   You are configuring firewall ACLs. You need to ensure that NTP traffic is allowed through. Which port must you specify in your ACL rule?

A.   UDP 161

B.   TCP 161

C.   UDP 123

D.   TCP 123

14.   Which server role stores network configuration objects in a centralized and replicated database?

A.   Directory service

B.   CUPS

C.   DNS

D.   DHCP

15.   Your intranet has a web server containing sensitive data. You want to encrypt communications between web browser clients and the web server. What should you do?

A.   Issue a PKI certificate for each client web browser. Install the certificates on the web server.

B.   Issue a PKI certificate for each client web browser. Install the certificates on each client.

C.   Issue a PKI certificate for the web server. Install the certificate on the web server.

D.   Issue a PKI certificate for the web server. Install the certificate on each client station.

16.   Which file and printer sharing protocol is used by Windows devices?

A.   Samba

B.   NFS

C.   SMB

D.   CUPS

17.   Your firewall has an ACL that allows inbound traffic destined for TCP port 25 to your company’s DMZ. What type of traffic is this?

A.   POP

B.   SNMP

C.   IMAP

D.   SMTP

18.   What term is used to refer to a host with at least two network interfaces?

A.   NIC teaming

B.   Multihomed

C.   MultiNICed

D.   NIC homing

19.   Which term is used to refer to a running virtual machine on a hypervisor?

A.   Host

B.   Node

C.   Device

D.   Guest

20.   Which type of hypervisor has direct access to physical hardware?

A.   Type 1

B.   Type 2

C.   Type A

D.   Type B

21.   You need to ensure that your cloud backup solution has guaranteed uptime. What must you have to ensure this?

A.   Network diagram

B.   Dataflow diagram

C.   Service level agreement

D.   Change control policy

22.   You have a Linux image that will be deployed to numerous virtual machines. The image should be pulled down over the network without providing boot media. Which option should you use?

A.   PXE

B.   DHCP

C.   DISM

D.   USB

23.   You want data center technicians to be able to scan equipment physically to facilitate hardware inventory gathering. What should you use?

A.   Bluetooth

B.   RFID

C.   Wi-Fi

D.   4G

24.   Which PowerShell cmdlet opens an interactive session with a remote host?

A.   Invoke-Command

B.   All PowerShell cmdlets using the -computername parameter

C.   Enter-PSSession

D.   Winrs

25.   Which of the following are considered out-of-band server management solutions? Choose two.

A.   SSH

B.   iDRAC

C.   iLO

D.   RDP

Questions and Answers

1.   Through which methods can on-premises servers communicate with cloud-based virtual machine servers? Choose two.

A.   Site-to-site VPN connection

B.   IPv6 leased connection

C.   Dedicated leased connection

D.   PKI

A, C. Site-to-site VPNs traverse the Internet and can link local and cloud networks together. Dedicated leased connections do not traverse the Internet and could also be used to link on-premises and cloud networks. B and D are incorrect. IPv6 supersedes IPv4 and has a larger address space as well as security and quality of service improvement, but there is no such thing as an IPv6 leased connection. PKI is a hierarchy of security certificates; it can be used to secure traffic but not to link two networks together.

2.   Which server role provides centralized IP configuration settings for clients?

A.   DNS

B.   IIS

C.   RDP

D.   DHCP

D. DHCP provides centralized IP settings that DHCP clients can use. A, B, and C are incorrect. DNS is a centralized name lookup service. IIS is Microsoft’s web server product. RDP is Microsoft’s Remote Desktop Protocol.

3.   You need to configure DHCP to deliver a specific IP address to a specific network printer. What should you configure?

A.   DHCP scope

B.   DHCP reservation

C.   Default gateway

D.   PXE

B. DHCP reservations tie an IP address to a MAC address of a device on the network. A, C, and D are incorrect. DHCP scopes contain address ranges and settings such as DNS server and default gateways. A default gateway sets the IP address(es) of the router(s) interface on the local network and enables traffic to be sent outside of the LAN. PXE is a network booting option often used for machine imaging purposes.

4.   Your network consists of Windows 10 computers and Android smartphones. You need to ensure that the Android devices are given IP addresses that place them on their own isolated VLAN. What should you do?

A.   Configure a DHCP vendor class identifier.

B.   Plug the Android devices into switch ports grouped into a VLAN.

C.   Configure a DHCP reservation.

D.   Configure a DHCP scope.

A. Vendor class identifiers can determine which type of device is connecting to DHCP and can assign IP settings for that type of device. B, C, and D are incorrect. Android devices do not have Ethernet ports for network cables. DHCP reservations tie an IP address to a device MAC address. DHCP scopes contain IP address ranges and related settings, but the scope applies to all devices by default.

5.   Your users report that they cannot access Internet resources today, although yesterday this worked fine. At a user station, you notice the IP address begins with 169.254. Why can’t user stations reach the Internet?

A.   A DHCP server cannot be reached.

B.   An incorrect subnet mask has been specified.

C.   An incorrect default gateway has been specified.

D.   An incorrect DNS server has been specified.

A. APIPA addresses are the result of a device not being able to contact a DHCP server. B, C, and D are incorrect. An incorrect subnet mask, default gateway, or DNS server won’t matter if the station is using a 169.254 address prefix.

6.   Which Windows command shows DHCP lease information?

A.   ipconfig /release

B.   arp -a

C.   nslookup

D.   ipconfig /all

D. The ipconfig /all command shows IP information including that related to DHCP. A, B, and C are incorrect. The ipconfig /release command releases DHCP-acquired IP configurations. The arp -a command shows IP address to MAC address resolution information. nslookup is a DNS diagnostic tool.

7.   What type of DNS record is used to resolve FQDNs to IP addresses?

A.   MX

B.   PTR

C.   A

D.   AAAA

C. A records, also called host records, resolve FQDNs to IPv4 addresses. A, B, and D are incorrect. MX records are mail exchange records used to locate SMTP mail servers. PTRs are pointer records used in reverse lookup zones to return a name, given an IP address. AAAAs are IPv6 host records.

8.   Which port does a DNS server listen on for client queries?

A.   UDP 53

B.   TCP 53

C.   UDP 3389

D.   TCP 3389

A. Client DNS queries target the DNS server on UDP port 53. B, C, and D are incorrect. TCP 53 is used for zone transfers between DNS servers. UDP 3389 is not normally used. TCP 3389 is the default RDP port on Windows hosts.

9.   You install a Windows DNS server named DNS1. Clients on the network are configured to use DNS1 for name resolution. Users report they are able to connect to Internet resources by name. You need to ensure that DNS resolves only internal names. What should you do?

A.   Remove the DNS server default forwarders.

B.   Remove the DNS server default stub zones.

C.   Add DNS server root hints.

D.   Remove the DNS server root hints.

D. DNS server root hints allow for Internet name resolution. A, B, and C are incorrect. There are no forwarders or stub zones by default, and adding DNS server root hints will not resolve the issue.

10.   You need to configure firewall ACLs to allow DNS server zone transfer traffic. Which port should your ACL allow?

A.   UDP 53

B.   TCP 53

C.   UDP 80

D.   TCP 80

B. TCP port 53 is used for zone transfer traffic between DNS servers. A, C, and D are incorrect. UDP 53 is used for DNS client queries, UDP 80 is not normally used, and TCP 80 is the default HTTP web server port.

11.   How do WINS and DNS differ?

A.   WINS uses a hierarchical naming structure; DNS uses a flat naming structure.

B.   WINS uses a flat naming structure; DNS uses a hierarchical naming structure.

C.   WINS uses AAAA records for IPv6; DNS uses A records for IPv6.

D.   WINS uses UDP port 53 for client queries; DNS uses TCP port 53 for client queries.

B. WINS simply resolves NetBIOS computer names to IP addresses; there is no hierarchy as there is in DNS. A, C, and D are incorrect. WINS is not hierarchical; DNS is. DNS A records are for IPv4; AAAA records are for IPv6. UDP 53 is used only for DNS client queries; TCP 53 is used for DNS server zone transfers.

12.   Your network servers point to NTP time servers connected to reference clocks. Which type of NTP time servers do you have on your network?

A.   Stratum 0

B.   Stratum 1

C.   Stratum 2

D.   Stratum 3

C. Stratum 2 NTP servers point to Stratum 1, which in turn uses a reference clock (Stratum 0). A, B, and D are incorrect. Stratum 0 is for reference clocks, Stratum 1 are time servers connected to reference clocks, and Stratum 3 servers point to Stratum 2 time providers.

13.   You are configuring firewall ACLs. You need to ensure that NTP traffic is allowed through. Which port must you specify in your ACL rule?

A.   UDP 161

B.   TCP 161

C.   UDP 123

D.   TCP 123

C. NTP uses UDP port 123. A, B, and D are incorrect. UDP 161 is for SNMP; TCP 161 and 123 are not normally used.

14.   Which server role stores network configuration objects in a centralized and replicated database?

A.   Directory service

B.   CUPS

C.   DNS

D.   DHCP

A. A directory service is a centralized and replicated database that stores network objects such as users, groups, and computers. B, C, and D are incorrect. CUPS is the UNIX- and Linux-based print server standard. DNS is used for name resolution. DHCP provides centralized IP settings for DHCP client devices.

15.   Your intranet has a web server containing sensitive data. You want to encrypt communications between web browser clients and the web server. What should you do?

A.   Issue a PKI certificate for each client web browser. Install the certificates on the web server.

B.   Issue a PKI certificate for each client web browser. Install the certificates on each client.

C.   Issue a PKI certificate for the web server. Install the certificate on the web server.

D.   Issue a PKI certificate for the web server. Install the certificate on each client station.

C. Only the web server requires a PKI certificate. A, B, and D are incorrect. Clients do not need a PKI certificate for secured web server traffic.

16.   Which file and printer sharing protocol is used by Windows devices?

A.   Samba

B.   NFS

C.   SMB

D.   CUPS

C. Windows file and printer sharing uses the SMB protocol. A, B, and D are incorrect. Samba enables Linux clients to contact Windows SMB shared resources. NFS is the UNIX and Linux file sharing standard. CUPS is the UNIX and Linux print server standard.

17.   Your firewall has an ACL that allows inbound traffic destined for TCP port 25 to your company’s DMZ. What type of traffic is this?

A.   POP

B.   SNMP

C.   IMAP

D.   SMTP

D. SMTP mail traffic has a destination port of TCP 25. A, B, and C are incorrect. POP uses TCP port 110, SNMP is UDP 161, and IMAP is TCP 143.

18.   What term is used to refer to a host with at least two network interfaces?

A.   NIC teaming

B.   Multihomed

C.   MultiNICed

D.   NIC homing

B. A host with at least two NICs is said to be multihomed. A, C, and D are incorrect. NIC teaming groups multiple NICs together for bandwidth aggregation or load balancing. MultiNICed and NIC homing are made-up words.

19.   Which term is used to refer to a running virtual machine on a hypervisor?

A.   Host

B.   Node

C.   Device

D.   Guest

D. A virtual machine is also called a guest. A, B, and C are incorrect. The hypervisor is referred to as the host. A node or device is a network entity that can transmit and receive packets.

20.   Which type of hypervisor has direct access to physical hardware?

A.   Type 1

B.   Type 2

C.   Type A

D.   Type B

A. Type 1 hypervisors have direct access to hardware without going through an operating system. B, C, and D are incorrect. Type 2 hypervisors go through an existing operating system for hardware access. Types A and B are not used to refer to hypervisors.

21.   You need to ensure that your cloud backup solution has guaranteed uptime. What must you have to ensure this?

A.   Network diagram

B.   Dataflow diagram

C.   Service level agreement

D.   Change control policy

C. Service level agreements specify details such as guaranteed uptime. A, B, and D are incorrect. Network and dataflow diagrams are useful documentation for troubleshooting, change management, and inventory purposes. A change control policy dictates steps that must be taken to make configuration changes.

22.   You have a Linux image that will be deployed to numerous virtual machines. The image should be pulled down over the network without providing boot media. Which option should you use?

A.   PXE

B.   DHCP

C.   DISM

D.   USB

A. PXE boots over the network and pulls down a small operating system to the local machine, often for imaging purposes. B, C, and D are incorrect. DHCP is used with PXE, but it does not provide boot and imaging options. DISM is a Windows command line tool that can be used to service Windows image files. Using a USB would mean technicians would have local boot media.

23.   You want data center technicians to be able to scan equipment physically to facilitate hardware inventory gathering. What should you use?

A.   Bluetooth

B.   RFID

C.   Wi-Fi

D.   4G

B. RFID enables devices to be scanned with RFID tags for inventory and tracking purposes. A, C, and D are incorrect. Bluetooth, Wi-Fi, and 4G are wireless technologies, but they are not designed specifically for inventory gathering.

24.   Which PowerShell cmdlet opens an interactive session with a remote host?

A.   Invoke-Command

B.   All PowerShell cmdlets using the -computername parameter

C.   Enter-PSSession

D.   Winrs

C. Interactive PowerShell sessions can be started with Enter-PSSession. A, B, and D are incorrect. Invoke-Command and the -computername parameter for some cmdlets enable remote code execution, but not interactively. Winrs is a Windows command line remote management tool.

25.   Which of the following are considered out-of-band server management solutions? Choose two.

A.   SSH

B.   iDRAC

C.   iLO

D.   RDP

B, C. Dell’s iDRAC and HP’s iLO are hardware-based, out-of-band remote management solutions. A and D are incorrect. SSH is used to manage any device securely and remotely with an SSH listener. RDP is used to manage Windows computers remotely.

CHAPTER 4

Server Storage

In this chapter, you will

•   Learn about various storage technologies

•   Understand why SSDs are superior to HDDs

•   Plan storage capacity

•   Learn about cloud storage options

•   Understand network storage

•   Learn how to install storage devices

•   Recognize ways to maintain file systems

•   Discover a variety of RAID configuration options

Today’s server storage implementations can be configured from a wide array of options based on several considerations, including whether the stored data is directly available to the server or whether it is accessible to the server over a network.

A variety of storage technologies are in use today. Large server rooms and data centers tend to use a collection of rack-mounted storage arrays available over a dedicated storage area network (SAN). For cloud-computing consumers, additional storage can be provisioned in seconds with the click of a mouse. Disks can be grouped together to increase disk read and write performance, to increase fault tolerance when disks fail, or to do both.

You need to understand storage options at both hardware and software levels, because when the data storage is seen by the server operating system, it needs to be configured—initialized, partitioned, and formatted. In this chapter, you will learn how to plan, choose, and configure storage to meet business needs.

Storage Technologies

A wide array of factors will influence your storage decisions, including decisions regarding where the storage will exist. Are you using cloud storage? Are the storage disks located inside the server itself, or are they accessible over an enterprise network?

Similar to server form factors, storage device dimensions and form factors have to be considered so that storage devices can be physically accommodated within servers or storage arrays. Today, 3.5-inch large form factor (LFF) hard drives are common. (This measurement refers to the diameter of the disk platters.) Small form factor (SFF) disks are 2.5 inches. (Note that you don’t need to be concerned with form factors when it comes to external USB drives.)

Regardless of the type of storage in use, two of your main concerns will be the storage capacity and how quickly you can read and write to storage. At the server level, today’s storage (per disk) falls somewhere in the 1 to 8 terabyte (TB) range, but this is constantly evolving. Of course, grouping disks together provides vastly greater storage capacity.

Magnetic Hard Disks

Old-school hard disks use magnetism to store data on metal platters. Hard disk drives (HDDs) are vacuum-sealed and contain multiple platters, each having read and write heads on an actuator arm to read and write data as the platter spins. You can see the actuator arm extended over the hard disk platter in Figure 4-1. Numerous factors influence disk speeds, as listed in Table 4-1.

Figure 4-1  The internal components of a magnetic hard disk

Table 4-1  Storage Speed Factors

The norm for desktop disks is 7200 RPMs; laptop disk speeds are around 5400 RPMs. Fast server hard drives spin at 15,000 RPMs, and you’ll pay more for these drives than for slower 10,000 RPM drives. Keep in mind that an increase in RPMs means a decrease in rotational latency, which translates to faster data access times.

Solid-State Drives

Solid-state drives (SSDs) have no moving parts, which means less physical wear and tear, less power required (no motors to drive), less heat, and less noise (less ventilation needs, as they run cooler because of reduced power draw). The biggest problem with SSDs, at least at the time of this writing, is that larger capacity SSDs are more expensive than the equivalent capacity magnetic hard disks.

Externally, SSDs aren’t much different from regular hard drives. Magnetic hard drives and SSDs are both plugged in using the Serial Advanced Technology Attachment (SATA) interface. Configuring and using the disk in the server operating system is the same regardless of drive type. There are also internal SSDs that can interface with the server via a Peripheral Component Interconnect (PCI) interface.

Some large external USB drives are simply enclosures that contain an internal magnetic hard disk. CompactFlash and Secure Digital (SD) storage are used for smaller devices such as cameras, audio recorders, and the like. The specific type of device, such as a digital camera, dictates whether you must use CompactFlash or SD storage. Both flash storage types are shown in Figure 4-2.

Figure 4-2  A USB flash drive (at left) and a 32GB SDHC (high capacity) flash memory card

Modern enterprise server environments often use a hybrid of SSDs and slower magnetic hard disks that are configured in different storage tiers. Different vendor solutions use varying methods of defining what gets stored on the faster SSDs; generally, frequently accessed data will reside on SSDs and less frequently accessed data is stored on the slower magnetic hard disks.

Public cloud providers also charge a premium when SSD storage is used. For example, when provisioning virtual machines in the cloud, we can opt for better performance by choosing a higher disk IOPS value. In the cloud, it’s important to deprovision unneeded resources (such as storage) to avoid unnecessary charges.

Hybrid Drives

You can probably guess what a hybrid drive is: it’s a combination of hard disk and solid-state technology in the same package. Often called solid-state hybrid drives (SSHDs), they consist of spinning platters as well as the faster flash memory. These drives cache frequently accessed data on the faster flash memory to improve performance.

Cost-wise, SSHDs fall between traditional hard drives and SSDs. Consider the following sample price comparisons (in US dollars):

•   1TB hard disk drive: $40

•   1TB SSHD: $60

•   1TB SSD: $90

You can see why SSDs are often used only for frequently accessed files or any type of disk-intensive activities related to reading and writing.

Storage Tiers

All storage and data are not equal: SSDs offer better performance than hard disks, and valuable data should be quickly accessible. Storage administrators can configure storage-tier policies that determine which type of data will be stored on which specific storage media. In the industry, this is generally referred to as hierarchical storage management (HSM).

As an example, EMC, the same company that owns VMware, offers the fully automated storage tiering (FAST) feature. Microsoft Windows Server also offers storage tier capabilities; you’ll need both SSD and HDD storage devices to set this up. After creating a storage pool from the physical disks and upon creating a virtual disk in the pool, you’ll get the option to create storage tiers on the virtual disk.

Because many servers today access data storage over a network, it makes sense to place tiered storage capabilities in front of SAN storage. Different vendor solutions have different naming conventions for storage tiers. Here are some examples:

Windows Server

•   Tier 1 (SSD)

•   Tier 2 (HDD)

Tier 1 storage (SSD) is used for frequently accessed and important data; Tier 2 storage (HDD) is used for less frequently accessed data.

EMC

•   Extreme performance tier (fastest)

•   Performance tier (middle of the road)

•   Capacity tier (slowest)

Disk Interfaces

Over the years, some disk interface standards have stood the test of time and have evolved, while others have been replaced by newer technologies. Take, for instance, the old IDE (Integrated Drive Electronics) disk interface standard that was common in the 1980s and 1990s, which is no longer commonly used. Instead, Serial ATA (SATA) (Figure 4-3) and Fibre Channel (FC) are the norm in server environments.

Figure 4-3  SATA disk data cable connectors

Table 4-2 lists common disk interface characteristics.

Table 4-2  Disk Interfaces

Optical Drives

Optical drives have slowly begun to fade away. When is the last time you burned a CD or DVD, or even a Blu-ray disc? Probably not recently. With the availability of cheap and fast external USB devices, consumers have moved away from optical media in favor of USB storage devices because they are easy to work with, they accommodate many writes—and they just work! Writing multiple times to an open CD or DVD, on the other hand, can be tricky, and you need the right software to do it.

Optical storage media is considered a form of Write Once Read Many (WORM) media. This enables data to be written once to the media and then read many times. Newer operating systems, including Windows, support optical media burning without requiring that you install additional software, despite the fact that it isn’t as common nowadays as it once was. There are occasions when a server may require a local optical drive to boot from for recovery purposes or to install an operating system. As long as the server has a USB interface, you’ll be able to plug in an external optical drive if needed. With the advent of server virtualization, Preboot Execution Environment (PXE) network boot, and operating system imaging, installing from optical media has become less common.

Cloud Storage

Public cloud storage has become popular for consumers and enterprises, and no wonder! All that’s needed is an Internet connection and a cloud provider subscription. You can provision (and deprovision) storage instantaneously and pay only for the space you use and potentially for data transfers out of cloud storage. Legal or regulatory restrictions may prevent the use of public cloud storage entirely or in certain geographic regions. Certainly cloud storage is not appropriate for every scenario—it’s just another option.

Your on-premises storage (servers and storage enclosures) can be configured to replicate or back up to the cloud as well, so hybrid solutions are also possible. The great thing about cloud storage is that somebody else deals with the disk devices, their configuration, and their availability on the network. As cloud consumers, we can connect from pretty much any device (such as a smartphone, as shown in Figure 4-4) on any network to access our files.

Figure 4-4  Accessing cloud storage from an Android smartphone

Direct-Attached Storage

Direct-attached storage (DAS) is the traditional server storage model in which storage disks are housed inside the server chassis and are locally available only to that server. So if the server is not accessing storage over some kind of a network, it’s DAS.

Network-Attached Storage

File-sharing protocols such as Microsoft Server Message Block (SMB) and the Network File System (NFS) for UNIX enable user connectivity to shared file systems over a network. Common Internet File System (CIFS) is a specific implementation of SMB. The fact that these higher layer protocols are used is a factor that distinguishes network-attached storage (NAS) from storage area networks (SANs). Another factor is that servers connect to NAS storage over a network consisting of standard network equipment and using standard network protocols such as Internet Protocol (IP). SANs are specialized high-speed networks designed to transmit disk I/O traffic using protocols designed for this use.

NAS can come in the form of a hardware appliance, such as the Dell device shown in Figure 4-5, which is essentially a disk enclosure with wired and wireless network connectivity and web management built into its firmware. In other cases, your NAS storage may be served up from a server configured solely for this purpose.

Figure 4-5  PowerVault NX3200 NAS device, Courtesy of Dell, Inc.

iSCSI

Internet Small Computer System Interface (iSCSI) is a form of SCSI, a decades-old standard used primarily for disk storage. To this day, it continues to evolve and is common in server environments. iSCSI makes storage accessible to hosts over a standard TCP/IP network on a small scale within a company.

The i in iSCSI refers to the fact that standard network equipment, such as standard Ethernet switches and cabling, can be used along with IP. Here’s what happens: SCSI disk I/O commands generated by a host (the iSCSI initiator) are placed inside IP packets. IP packets have the delivery details, such as the identity of the server or appliance serving up the disk space (the iSCSI target). Standard network hardware and software makes iSCSI possible; compared to a dedicated Fibre Channel SAN, iSCSI is less expensive, slower, and less reliable.

A separate network segment, or virtual local area network (VLAN), configured within or between network switches should be dedicated for iSCSI use; there’s enough overhead involved already by stuffing disk commands into IP packets that need to be addressed and transmitted. What makes this solution attractive is its price tag, and it gets the job done.

iSCSI Initiators  The iSCSI initiator can be implemented as software or hardware. Hardware initiators support enhanced options such as a server booting the operating system over the network; this isn’t possible with software initiators because the OS has to be running before the initiator is available. Before the initiator can contact the target, it needs some kind of network address and port. The port identifies the services running on the host, and in this case it’s TCP port 3260. This could be a hostname such as storage1.acme.local or an IP address such as 172.16.54.56. After the host connection is established, we then specify the logical unit number (LUN) using an iSCSI qualified name (IQN) such as iqn.2012-06.com.sample:target0.

iSCSI Targets  The iSCSI target hosts the disk space on an IP network, and that space gets consumed by servers, as depicted in Figure 4-6. Storage administrators carve out different chunks of disk space for servers to consume. These chunks of disk space are called logical unit numbers because traditional storage protocols such as SCSI used a unique numeric value to refer to disk storage.

Figure 4-6  iSCSI initiators connect to iSCSI targets using TCP/IP.

NOTE   iSCSI LUNs can also be consumed by some client operating systems and devices. For example, a Windows 10 machine can consume an iSCSI LUN; to Windows 10, it’s just more available disk space.

FCoE

Fibre Channel is a high-speed transmission method often used to connect servers to network storage. Despite “fibre” being in the name, it does not require fiber-optic cabling; standard twisted pair copper cables will work just fine. Because the FC standards are designed for speed and reliability, they are more often used in data centers or by service providers.

Fibre Channel over Ethernet (FCoE) stuffs disk commands into Ethernet frames as opposed to using higher level IP packets, which introduce more overhead. But for this to work, you need the correct hardware:

•   Converged network adapters (CNAs) in each server, which combine Ethernet and FC functionality in a single card

•   FCoE switches, which serve as the connection point between servers and storage arrays

•   Copper or fiber-optic cables

NOTE   Virtualization environments such as VMware and Microsoft Hyper-V enable virtual machines to communicate with a SAN through a physical FC host bus adapter (HBA) installed in the hypervisor host. The correct FC HBA driver must be installed for this to work.

Storage Area Networks

A SAN separates storage from individual hosts. Hosts connect to storage over the network and that storage appears, to the host operating system, to be a local storage device. iSCSI SANs use standard networking equipment and TCP/IP to make this happen. SANs can also consist of specialized network equipment and network storage protocols such as FC. You’ll find FC SANs used in larger enterprises, data centers, and service providers, and the cost can range from tens of thousands of dollars into the millions!

FC speeds currently fall in the range of 1 to 32 Gbps. FC SANs incur less overhead than higher level protocols such as IP used with iSCSI. FC SAN devices need a FC HBA to connect to SAN storage. The HBA has a unique16-digit hexadecimal identifier, called a World Wide Node Name (WWNN). The HBA in a server can have multiple ports, and each can connect to different FC switches for redundancy. Each port can be configured with a World Wide Port Name (WWPN). For example, a FC switch can have a single WWNN plus a WWPN for each port. Storage arrays are connected to FC switches. Collectively, this topology is referred to as a fabric. Other devices take on this nomenclature, too, as in fabric switches.

Storage administrators configure LUNs and LUN masks to determine which servers can use which configured storage. A LUN uniquely identifies disk space on the storage array. A LUN mask is normally configured at the HBA level, so that, for example, we can prevent Windows Server from seeing specific LUNs used by Linux servers. A simple FC SAN fabric is depicted in Figure 4-7.

Figure 4-7  A FC SAN using redundant switches

NOTE   Larger SANs will use zoning instead of LUN masking. Zoning is configured at the FC switch level and does not apply to FCoE or iSCSI. It groups nodes into zones, much like organizing devices on their own IP subnets. This enables you to control LUN visibility to all nodes in the same zone. To achieve this with FCoE or iSCSI, you would use separate VLANs.

Storage Capacity and Future Growth

When it comes to servers, a myriad of questions need answers. What is the server’s purpose? How many users will be connecting at once? How critical is it that the server stay up and running? Planning servers before jumping into the actual configuration is paramount. One part of this is trying to anticipate server storage needs. And this is where cloud computing (specifically, Infrastructure as a Service, or IaaS) can be very useful.

When you work with on-premises storage, you have to order storage devices, wait for them to be shipped, plug them in, configure them, and then the storage can be used. If, over time, you don’t need all of the storage, well, you paid for it all either way. This is one reason why cloud storage makes a lot of sense. By definition, cloud services must support the following:

•   A pool of resources shared by multiple tenants

•   IT services available on demand from anywhere using any device

•   Rapid elasticity (I need more disk space right now!)

•   User (not service provider) provisioning and deprovisioning

•   Metered services (pay only for storage used)

Base 2 vs. Base 10

Imagine one of your users asking you to explain a kilobyte. Would you say, “It is a term to express 1000 bytes,” or would you say, “It expresses 1024 bytes”? Those 24 little bytes can really add up when you’re calculating server storage needs, especially in a data center or service provider environment!

We humans normally express numbers using base 10. Why? There are a few theories:

•   We have 10 digits on our two hands.

•   The pope said so in the Middle Ages.

•   Our financial systems do it this way.

It really doesn’t matter why. It just is. Computers, however, don’t do base 10—they do base 2, or binary, where everything is collections of 0’s and 1’s. So with base 10, we could say 103 = 1000 (10 × 10 = 100, 100 ×10 = 1000). With base 2, we would say 210 = 1024 (2 × 2 = 4, 4 × 2 = 8, and so on). Therefore, a 1 terabyte (TB) drive is 1,099,511,627,776 bytes (that’s 1 trillion and change), not just 1 trillion. The difference here is 99 billion bytes!

Where Did All the Disk Space Go?

Remember the line from the movie Field of Dreams, “If you build it, they will come”? Well, for disk space our statement of wisdom will be, “If you make it available, it will be consumed.” As storage capacity increases and becomes affordable, we seem to have a need to gobble it all up for storing movies, music collections, company data, operating system images, and so on. Here is a partial list of disk space consumers:

•   Operating system files

•   Operating system patches and service packs

•   Operating system images

•   Driver and application updates

•   Log files

•   Temporary files

•   Data files

•   Data backups and archives

You can imagine that a customer-transaction database for a large online retailer would consume an increasing amount of disk space, especially over time. Any application server resulting in data is a potential item to consider. File servers housing thousands of user home directories are prime candidates for running out of space. Some companies use on-premises or cloud-based policy-driven software that automatically archives data not accessed frequently to slower, cheaper storage media (a different storage tier). Windows Servers use the Volume Shadow Service (VSS), also referred to as the Volume Shadow Copy Service, for backups to enable data backup without requiring applications to be taken offline during the backup.

Using Less Disk Space

What can we do to use less storage space? Disk quotas can limit how much disk space is used either in a folder (regardless of who places content there) or even by user (such as on a file server). Some quota tools support soft quotas, where the quota is not enforced, but a log entry is made noting that the quota has been reached. Hard quotas are enforced. Windows Server user quotas can be set using the GUI, as shown in Figure 4-8.

Figure 4-8  Setting user disk quotas in Windows Server

As a server technician, when you create server disk volumes, you have the option of thin provisioning, which is also referred to as overbooking or overcommitted disk space. Here’s how thin provisioning works:

1.   A server admin adds 500GB of new storage to a server.

2.   The admin creates disk volume 1, which is thinly provisioned during creation and is set to a size of 500GB.

3.   The admin creates disk volume 2, which is thinly provisioned during creation and is set to a size of 500GB.

Wait a minute! That’s 1TB of disk space you may use down the road, but there is only 500GB of physical storage! The beauty here lies in the fact that both disk volumes will use disk space as they grow over time, but in the end you are limited to 500GB. With thin provisioning, you don’t have to know ahead of time exactly how much space each volume will end up needing. Figure 4-9 shows thin provisioning being configured within the Windows Server operating system.

Figure 4-9  Thin provisioning option in Windows Server

Compression

Disk compression tools save disk space by reducing redundant occurrences of data. Windows and Linux servers let you work with compression in the GUI or at the command line. For example, on a Windows server, you can compress all files on drive D:\ with the following command:

compact /c /i /d:\

From a terminal prompt on a Linux host, you could use

gzip -r zipped_budgets.gz /budgets_2020 /budgets_2021

Data Deduplication

Data deduplication can remove redundant data blocks to conserve space. Windows Server includes data deduplication for NTFS volumes, but it’s not installed by default. There are also tools available to measure where your current disk space is being used to aid in planning future storage capacity. One example is Microsoft’s File Server Resource Manager (FSRM), shown in Figure 4-10, which is included with the Windows Server OS.

Figure 4-10  FSRM storage report

Windows Image Files

The standard file type for storing Windows images is the .WIM format. You can save disk space by storing multiple images of the same operating system within a single .WIM file. Suppose, for example, that you have five Windows 10 images used within the company, and each image is approximately 10GB, for a total of 50GB. If you were to store those five images in a single .WIM, the total consumed disk space might be only 25GB. The reason is single-instance storage; multiple copies of files are stored only once, thus saving space.

You can use the Deployment Image Servicing and Management (DISM.exe) tool to work with Windows image files. DISM is built into newer operating systems such as Windows 10 and Windows Server 2019.

The following example creates an image of drive C:\ and appends it to Z:\win10_images.wim with a name of win10_sales:

Dism /Append-Image /ImageFile:Z:\win10_images.wim /CaptureDir:

C:\ /Name:win10_sales

The following example applies the win10_sales image stored in the win10_images.wim file to the C:\ drive:

Dism /Apply-Image /ImageFile:Z:\win10_images.wim /name:win10_sales

/ApplyDir:C:\

Of course, DISM isn’t the only game in town; other tools such as imagex.exe, Microsoft Deployment Toolkit (MDT), and Microsoft System Center Configuration Manager (SCCM) do a fine job when working with Windows images.

RAID Configuration

Groups of disks not yet configured to work together are called JBOD—just a bunch of disks. RAID (Redundant Array of Independent Disks) takes a much more structured approach, and for years it has been widely used in enterprise computing ecosystems. RAID enables you to group multiple physical disks together as a logical manageable unit for two reasons: improved disk I/O performance and fault tolerance. The operating system may see what it thinks is one disk, when in reality the RAID array may consist of several disks working together.

Hardware RAID support is normally integrated on server motherboards, but if it isn’t, you can get expansion cards (RAID controllers) to make this possible. Software RAID (see Figure 4-11) is built into server OSs, but, of course, if something goes wrong with the OS, something might go wrong with the RAID disk array. Not only that, but remember that firmware designed for one purpose always outperforms software designed for many uses, so it’s a good idea to use hardware RAID whenever possible. In Windows, using software RAID requires disks to be treated as dynamic disks; disks start off as basic disks, but you are prompted to convert to dynamic disks when configuring software RAID levels.

Figure 4-11  Configuring software RAID in Windows Server

Hardware RAID array controllers often have their own battery-backed caches, which work well when disk writes to the array aren’t committed immediately and an issue occurs, such as a power outage. Upon restart, cached data is actually committed to disk. In the spirit of redundancy (remove single points of failure!), you can also use redundant RAID controllers. Interestingly, RAID level 1 (disk mirroring), when two disks are connected to two different controllers, is called duplexing. Figure 4-12 shows how hardware RAID storage shows up in Windows Server.

Figure 4-12  An Intel RAID 0 volume in Windows Server

RAID Levels

RAID levels consist of various disk configurations. The following sections summarize the characteristics of a few common RAID levels.

RAID 0

•   Uses disk striping

•   Requires at least two disks

•   Data to be written to disk is broken into blocks (stripes) that are evenly written across the disk array

•   Improves disk I/O performance

•   Offers no fault tolerance

RAID 1

•   Uses disk mirroring

•   Requires at least two disks

•   Data written to a disk partition on one disk is also written to a disk partition on a different disk

•   Can use only 50 percent of disk space

•   Tolerates a disk failure

•   Does not replace backups

RAID 5

•   Uses disk striping with distributed parity

•   Requires at least three disks

•   Data to be written to disk is broken into blocks (stripes) that are evenly written across the disk array

•   Stores parity (error recovery) information for each stripe on a separate disk from its related data stripe

•   Tolerates a single disk failure

•   Can reconstruct in memory and on demand any data from failed disk

RAID 6

•   Uses double-parity RAID

•   Requires at least four disks

•   Data to be written to disk is broken into blocks (stripes) that are evenly written across the disk array

•   Stores two parity (error recovery) stripes on each disk

•   Never stores parity and its related data on the same disk

•   Tolerates two disk failures

•   Can reconstruct in memory and on demand any data from failed disks

RAID 10

•   Uses RAID level 1 and then 0

•   Uses disk mirroring followed by striping

•   Provides fault tolerance and performance

•   Requires at least four disks

•   Stripes data across mirrored pairs

•   Tolerates multiple disk failures as long as they are not in the same mirrored pair

•   Is useful for busy (many reads/writes) databases

EXAM TIP   You will be tested in some way on your RAID knowledge. Make sure you understand how to visualize the RAID levels in terms of where data versus parity are stored, how many disks are required, and when a specific RAID level solves a problem.

Storage Device Installation

Installing storage devices begins with knowing what you have and progresses to knowing what you need. A rack-mounted server with an integrated SAS RAID controller may or may not accept SATA disks; it depends on the specific RAID controller. In the same way, a disk subsystem might accept only 4 disks, or it might accept 128. But after the connectivity is taken care of, disk space must be configured appropriately and file systems created.

MBR and GPT

When servers can see disk space, whether storage is DAS, NAS, or over a SAN, the next step is to make the space usable. This means initializing disks, partitioning them, and formatting those partitions with a particular file system. Disk initialization is required for server operating systems to be able to use the space, and you can choose either master boot record (MBR) or GUID Partition Table (GPT) for this. MBR and GPT are a function of the server’s firmware (BIOS/UEFI) and the operating system, not the disk itself.

MBR is the old 1980s 32-bit standard for disk initialization that supports a maximum of four primary disk partitions, each being no larger than 2TB in size. Another MBR option is to create three primary partitions and one extended partition in which you can then create multiple logical drives, but this is rare these days.

GPT is a newer, 64-bit standard for initializing disk space that supports many very large partitions (the values vary depending on the OS and file system used). Windows Server will allow up to 128 partitions, each being up to 256TB in size, although theoretically the partition size could be up to 9.44 zettabytes (ZB). GPT also stores partitioning information in multiple places on the disk, which makes it much more resilient to corruption compared to MBR. Booting from a GPT-initialized disk requires UEFI (as opposed to BIOS) and, in the case of Windows Server OSs, also requires a 64-bit operating system.

Windows systems can use the diskpart.exe command line tool or the GUI Disk Management (shown next) and Server Manager tools to work with disks. Server Manager doesn’t even give you the option of initializing a disk using MBR. Those using Linux systems can use the old fdisk command to work with MBR; the gdisk command is used for GPT. Linux also supports using Logical Volume Management (LVM) to group physical disks together upon which logical volumes can be created. A single logical volume could span multiple physical disks.

File Systems

File systems are determined when you format a disk partition. Each server OS supports various file systems—some old, some new—that can meet your requirements. For example, if you want user disk quota and file encryption support on a Windows server, you should be using NTFS.

Windows Server OSs generally support the following file systems:

•   File Allocation Table (FAT)

•   FAT32

•   Extended FAT (exFAT)

•   New Technology File System (NTFS)

•   Resilient File System (ReFS)

NTFS (shown next), which supersedes FAT and FAT32, is a journaled file system that supports compression, encryption, file system security, larger file and partition sizes, and user disk quotas, to name just a few features. FAT32 and exFAT are used most commonly with removable storage such as flash drives, although you can format flash drives as NTFS.

ReFS is a newer file system made available in the Windows Server OS that is designed to be more resilient to file system corruption. It boasts new features, including the ability to scan for and correct file system corruption while the disk volume is mounted and in use. But it has drawbacks: for example, ReFS doesn’t support Encrypting File System (EFS), data deduplication (pre-Windows Server 2019 version 1709), and it can’t be used on an OS boot drive.

UNIX and Linux server OSs generally support the following file systems:

•   UNIX File System (UFS)

•   Zettabyte File System (ZFS)

•   Extended File System (EXT2, EXT3, EXT4)

•   ReiserFS

EXT4 and ReiserFS are common in today’s Linux environments, although development support for ReiserFS appears to be waning. Both of these file systems are journaled, which means all file system write transactions are logged before being committed to disk. This makes the file system less susceptible to corruption, which can occur with a power loss, for example.

NOTE   Don’t confuse network file-sharing protocols with local file system types. For instance, Network File System (NFS) is a UNIX and Linux file-sharing protocol, and Server Message Block (SMB) is a Windows file-sharing protocol. You don’t format local disk volumes as NFS or SMB.

The Virtual Machine File System (VMFS) is specific to VMware. It was designed to support simultaneous read/write activity by cluster nodes where virtual machine hard disk files and snapshots (checkpoints) are concerned. One benefit of VMFS is that it enables the live migration (movement) of virtual machines between VMware ESXi hosts with zero downtime. The Microsoft Failover Clustering feature does support Cluster Shared Volumes (CSVs), which enable the live migration of Hyper-V virtual machines between clustered Hyper-V hosts with zero downtime.

For resilience to disk failures, some drive enclosures, also called storage rack cages, support hot-swappable disks. This means failed disks can be replaced while everything stays running. If you’re not using all the disks, you can have extra ones plugged in—these are hot spares. Cold spares are extra disks that you can swap out when used disks fail; doing this requires that the system be shut down. Storage rack cages are normally powered and have fans and interface cards for data and power conversion of power connectors such as for SATA and Molex.

Sample Scenario 1

In this scenario, you’re a storage tech working in a data center with multiple tenants. You’re working on some new virtualization servers that customers will use to run their virtual machines. Each physical server motherboard supports SAS RAID and has four SATA ports, one of which is currently used by a disk containing the server OS. Your boss is after you to get the best possible performance for virtual machines while allowing for the possible failure of one disk. What should you do?

Given this scenario, the best solution is to acquire three fast, high-capacity SATA disks and configure them using hardware RAID in a stripe set with distributed parity (RAID 5). RAID 5 needs at least three disks; RAID 6 needs four, which is not an option here. With RAID 5, you’re spreading the disk I/O workload across three disks while also writing parity information in case one disk fails.

Sample Scenario 2

Your company is using FC SAN with multiple FC switches connected to SSD and hard disk storage arrays. A new blade server has arrived. The blade will run Windows Server Hyper-V by booting from the SAN and will host two virtual machines running customer management software. You must ensure that both virtual machines have redundant connectivity to a log file storage volume and an application database storage volume on the SAN. Log files should be stored as archives on slower disks, while database access must be as fast as possible. How should you go about this?

The first clue here is redundant SAN connectivity—this means you need a dual-port FC HBA for multiple paths to different FC switches. You will also need the correct HBA driver so that the two virtual machines can talk to the SAN directly.

Storage administrators will have to configure three LUNs in this case: one to host the Windows Server OS (boot from SAN), a second LUN for log files, and a third LUN for the database. Storage tiers need to be configured so that the database and related files are available on fast SSDs, while logs are stored on hard disks.

Hands-on Exercises

Exercise 4-1: Configure a Windows Server iSCSI Target

1.   Start your Ubuntu Linux virtual machine. At the login prompt, type uone and press ENTER. Type Pa$$w0rd172hfX and press ENTER.

2.   Type ip a to view the IPv4 address acquired through DHCP. Write down this IP address; you will need it in a later step. Leave the virtual machine running for the next exercise.

Install the iSCSI target software from PowerShell

3.   Make sure your Srv2019-1 virtual machine is running in VMware Workstation and that you are logged on using the Administrator account with a password of Pa$$w0rd172hfX.

4.   Click the Windows Start menu and enter powershell. When Windows PowerShell shows up in the search results, select it.

5.   Enter install-windowsfeature fs-iscsitarget-server. After a few moments, the software is installed.

6.   Enter get-windowsfeature *isci*. The asterisks are wildcards that will show features containing the text iSCSI. Notice the X in the box for iSCSI Target Server, which implies that the software has indeed been installed.

Configure iSCSI storage on the target

7.   If it is not already running, start Server Manager from the Start menu.

8.   In the navigator on the left, click File And Storage Services, and then click Disks. You will create a dedicated storage volume for iSCSI virtual disks.

9.   Right-click the second listed disk (take note of the disk number) and choose New Volume. Click Next twice to accept the default settings. If prompted that the selected disk will be brought online and initialized as a GPT disk, click OK.

10.   In the Specify The Size Of The Volume Window, for the volume size, enter 30GB. Click Next.

11.   Choose Don’t Assign To A Drive Letter Or Folder and click Next.

12.   Enter a volume label of iSCSI Virtual Disks and click Next.

13.   On the summary screen, click Create, and then click Close.

14.   In the upper-right, click Tasks, and then click Refresh. Select the disk number from step 9.

15.   In the Volumes panel below, right-click the listed volume and choose Manage Drive Letter And Access Paths. From the Drive Letter drop-down list, choose drive I. Click OK.

Create iSCSI virtual disks for consumption over the network

16.   Within Server Manager, in the navigator on the left, click iSCSI.

17.   Click the Tasks button on the upper-right and choose New iSCSI Virtual Disk.

18.   Click the Browse button and navigate to drive I:\ to store the iSCSI virtual disks. Click Select Folder. Click Next.

19.   Enter iscsi_lun1 for the name and click Next.

20.   Enter 10GB for the size and click Next.

21.   Ensure that New iSCSI Target is selected and click Next. This is where you specify which network hosts are allowed to access this iSCSI storage.

22.   For the name, enter LocalServers and click Next.

23.   Click Add. From the Type drop-down list, select IP Address.

24.   In the Value field to the right, enter the IP address you wrote down in step 2. This is the IP address of Ubuntu Linux server, which will consume this storage. Click OK.

25.   Click Next twice, click Create, and then click Close. Your iSCSI VDHX file is created.

26.   Close Server Manager.

Exercise 4-2: Use the Ubuntu Linux iSCSI Initiator to Connect to an iSCSI Target

1.   Make sure your Ubuntu-1 virtual machine is running in VMware Workstation. If you’re not already logged in, at the login prompt, type uone and press ENTER. Type Pa$$w0rd172hfX and press ENTER.

2.   You will now connect to the iSCSI target on Srv2019-1 (192.168.1.200). Enter the following command and then press ENTER. Because this is the first time in this session you’re using the sudo command, you’ll need to reenter the password for user uone.

sudo iscsiadm --mode discovery --type sendtargets

--portal 192.168.1.200

3.   In the command output, notice the first returned IQN item after 192.168.1.200:3260,1, which will look something like this:

iqn.1991-05.com.microsoft:srv2019-1-localservers-target

4.   To connect to the iSCSI target storage, enter

sudo iscsiadm --mode node --targetname the_IQN_noted_

above in Step 3 --portal 192.168.1.200 –-login

5.   Enter

lsblk --scsi | grep iscsi

6.   Notice (from step 5) the connected iSCSI disk and its name (for this example, we will assume the name is sdd).

7.   Enter sudo fdisk /dev/sdd and press ENTER.

8.   Press the n key (for new partition, and make sure it is lowercase) and then press ENTER, and keep pressing ENTER to accept the defaults to use the entire disk for this primary partition.

9.   At the Command (m for help): prompt, press the w key (for write, and make sure it is lowercase) to save the changes to disk.

10.   To format the new partition (sdd1), enter sudo mkfs /dev/sdd1.

11.   Create a mount point folder by entering sudo mkdir /project-x.

12.   Mount the new partition into the folder by entering sudo mount /dev/sdd1 /project-x.

13.   Verify the mount succeeded by entering mount | grep project. The Ubuntu Linux host is now using the remote disk space housed on the Windows iSCSI target server.

14.   Switch to the Windows Server iSCSI target. Start Server Manager, and in the iSCSI view, below the iSCSI targets section, notice the Initiator ID shows the Linux host IP address. The Linux host is now consuming the disk space over the network. Leave this server running.

Exercise 4-3: Configure Software RAID Using Windows Server

This exercise demonstrates how two disk volumes can be thinly provisioned to use all available space in the storage pool.

1.   On Srv2019-1, start PowerShell from the Start menu.

2.   Create a variable to store disks eligible to be added to a storage pool, and then create a storage pool by entering

$disks=(Get-PhysicalDisk –CanPool $True)

Then press ENTER and type the following:

New-StoragePool –FriendlyName SWRaid –

StorageSubSystemFriendlyName "Windows Storage*" –

PhysicalDisks $disks

3.   If it’s not already running, start Server Manager from the Start menu.

4.   On the left, click File And Storage Services, and then click Storage Pools.

5.   Right-click the SWRaid storage pool and choose New Virtual Disk. If you don’t see the SWRaid storage pool, exit Server Manager and start it again. Note that “virtual disk” in this context has nothing to do with virtualization. Click OK, and then click Next.

6.   Enter the name of the new virtual disk, Vdisk1, and click Next twice.

7.   On the Select The Storage Layout screen, ensure that Simple is selected to configure disk striping across the three disks. Then click Next.

8.   For the Provisioning Type, choose Thin and click Next.

9.   Enter 145GB as the size and click Next. Click Create and then click Close.

10.   The New Volume wizard will automatically launch. Click Next five times to accept the defaults. On the Confirm Selections screen, take note of the drive letter for the new disk volume. Click Create and then click Close.

11.   In the navigator at the left, click Volumes. On the right, notice the new drive letter (for example, E:\).

12.   Start Windows Explorer and notice the new drive letter for your new striped volume. It appears as a single drive letter in Windows, but the volume is really spread across three physical disks, which results in enhanced disk performance; however, if a single disk fails, the entire striped drive will become unavailable.

Exercise 4-4: Configure Software RAID Using Ubuntu Linux

1.   Make sure your Ubuntu-1 virtual machine is running in VMware Workstation If you’re not already logged in, At the login prompt, type uone and press ENTER. Type Pa$$w0rd172hfX and press ENTER.

2.   Enter sudo lsblk --scsi to list SCSI disk block devices. You should see sda, sdb, and sdc. These are three separate disks. We will create a disk mirror between sdb and sdc.

3.   Enter sudo fdisk /dev/sdb and press ENTER. Press the n key (for new partition; must be lowercase) and then press ENTER four times to create a primary partition that consumes the entire disk.

4.   Press T to change the partition type, and then enter fd to set the type to Linux raid autodetect.

5.   Press the w key (for write, and make sure it is lowercase) to write the changes to disk.

6.   Repeat steps 4–6 in this exercise, except in step 3, enter sudo fdisk /dev/sdc instead of /dev/sdb.

7.   Enter sudo fdisk -l /dev/sdb /dev/sdc to verify that the Linux raid autodetect partition flag has been set on both disk partitions (look under the Type heading). Notice the partitions are /dev/sdb1 and /dev/sdc1 (look under the Device heading).

8.   Create a software RAID 1 (mirroring) configuration:

sudo mdadm --create /dev/md1 --level=1 –-raid-devices=2 /

dev/sdb1 /dev/sdc1

9.   Press Y (for yes) to continue creating the array.

10.   Verify your work:

sudo mdadm --detail /dev/md1

11.   Make a useable file system on the mirrored array:

sudo mkfs -t ext4 /dev/md1

12.   Make a mount directory:

sudo mkdir /cust_trans

13.   Mount the file system to a directory so it is ready to use:

sudo mount /dev/md1 /cust_trans

14.   Enter the following command to verify the /cust_trans mount point is using the disk mirror device /dev/md1:

mount | grep /dev/md1

Chapter Review

Server storage is a crucial part of server planning, including potential future disk space requirements. This is especially true for data center administrators, because consumers expect storage to be available when they decide to provision more space.

Storage Device Characteristics

Characteristics such as RPMs, seek time, rotational latency, bus width, and IOPS all contribute to the overall transfer rate of data into and out of hard disks.

Hard disks consist of read and write heads on mechanical arms that move over the spinning platters. Solid-state drives (including flash drives) have no moving parts; everything is electronic. SSDs generally perform faster but are more expensive than hard disks.

Disk Interfaces

Disk interfaces include

•   SAS (common in servers)

•   SATA

•   SCSI

•   USB

•   Fibre Channel (used in SANs)

Local and Network Storage

DAS storage is available locally to a server without using a network. NAS uses file-sharing protocols such as SMB and NFS to make network storage available. SANs use specific disk block I/O protocols for high-speed access to network storage. SAN-specific equipment includes FC HBAs in each server, FC switches, and storage arrays. LUNs represent disk space available over the network. Techniques such as LUN masking and zoning are used to restrict server access to specific LUNs.

iSCSI enables storage consumption by hosts over a standard TCP/IP network. iSCSI initiators connect to iSCSI targets either on the same or on a different subnet. iSCSI traffic should be kept separate from other TCP/IP traffic by configuring a dedicated iSCSI VLAN.

FCoE incurs less overhead than iSCSI because it packages disk I/O commands directly into Ethernet frames instead of higher level IP packets. CNAs and FCoE switches are required, but fiber-optic cabling is not; copper-based cables will also work.

Storage Capacity Planning

Planning for future storage capacity can be measured using base 2 or base 10. Base 2 is more specific (binary) and more closely reflects actual required disk space. Compression, data deduplication, disk quotas, and thin provisioning are options for optimizing disk space use.

RAID

RAID treats multiple physical disks as a group, but the operating system sees only one logical disk. RAID is used to squeeze more disk I/O performance (multiple disks reading and writing instead of just one) and to provide fault tolerance (disks that will fail).

•   RAID 0  Disk striping

•   RAID 1  Disk mirroring

•   RAID 5  Disk striping with distributed parity

•   RAID 6  Disk striping with dual distributed parity

•   RAID 10  Combines RAID 1 with RAID 0

Disk Initialization and File Systems

MBR and GPT do not refer to a type of hard disk; disks are initialized in an operating system as either MBR or GPT. MBR allows a maximum of four partitions, each with a maximum potential size of 2TB. GPT limits are imposed by specific operating systems; Windows Servers allow up to 128 GPT partitions, each being 256TB in size. Booting from GPT requires UEFI.

After disk initialization, the disk must be partitioned. A single disk could be carved out to include an OS bootable partition, a data partition, a swap file (page file) partition, and so on. When installing specialized operating systems such as the VMware ESXi hypervisor, you can create an optional scratch partition to accommodate diagnostic output. Swap/page/scratch partitions are also useful when the system is low on memory; the oldest used memory pages can be swapped out to disk to free up space in active memory. A general rule of thumb is to ensure this partition is at least 1.5 times the size of the amount of RAM installed in the host.

After disk partitioning, file systems are created when the partition is formatted. Windows servers typically use NTFS, where Linux servers vary: EXT2, EXT3, EXT4, and ReiserFS are common. VMFS is a file system specific to VMware hosts that enables concurrent reading and writing to a disk volume by multiple cluster nodes, similar to Microsoft CSVs.

Questions

1.   A new 4TB drive was added to a server, but you notice that the server operating system can use only 2TB. What is the most likely cause of the problem?

A.   The drive was initialized as GPT.

B.   The drive was initialized as MBR.

C.   The operating system has not been updated.

D.   Compression is enabled.

2.   What hard disk dimension is considered the standard?

A.   1.75-inch

B.   3-inch

C.   5.5-inch

D.   3.5-inch

3.   Which disk speed factor does not apply to SSDs?

A.   IOPS

B.   Capacity

C.   Rotational latency

D.   Transfer rate

4.   Which disk interface standard is the most common in servers?

A.   SAS

B.   IDE

C.   SATA

D.   EIDE

5.   Your server environment requires the ability to replace a failed disk while systems remain running. What type of disk system must you use?

A.   Hot-swappable

B.   UEFI

C.   Drive-swappable

D.   RAID

6.   Identify the Windows supported file systems. Choose two.

A.   eFAT

B.   ReFS

C.   XFS

D.   NTFS

7.   How does a SAN differ from NAS?

A.   There is no difference.

B.   SANs use IP and NAS does not.

C.   SANs are local server storage and NAS is not.

D.   SANs use specific block I/O protocols and NAS uses standard file-sharing protocols.

8.   One of your locations is using iSCSI for server network storage. You want to ensure that regular TCP/IP traffic does not impede iSCSI performance. What should you do?

A.   Use a separate VLAN for iSCSI.

B.   Configure LUN masking.

C.   Configure LUN zoning.

D.   Enable iSCSI CHAP authentication.

9.   Which statement regarding software iSCSI initiators is true?

A.   Targets are accessible only through FC switches.

B.   They do not support OS booting from SAN.

C.   IPv6 must be configured.

D.   iSCSI targets must reside on the same subnet with iSCSI initiators.

10.   Your boss has asked you to determine what equipment must be ordered to set up a new FCoE environment. Which FCoE item is required?

A.   NAS device

B.   CNA

C.   UEFI

D.   RAID controller

11.   You are a Linux server administrator. To plan future disk space requirements, you would like to track user disk space consumption. What should you configure?

A.   Hard quotas

B.   GPT

C.   NTFS

D.   Soft quotas

12.   As you configure three new server disk volumes, you are unsure as to how large each volume should be. What should you configure?

A.   Thin provisioning

B.   Thick provisioning

C.   RAID 0

D.   RAID 1

13.   Which RAID level offers the best performance?

A.   RAID 0

B.   RAID 1

C.   RAID 2

D.   RAID 3

14.   Which type of storage would be considered Tier 2 storage?

A.   SCSI

B.   IDE

C.   SSD

D.   HDD

15.   Which type of storage combines disk platters with flash memory?

A.   SSHD

B.   SSD

C.   HHDD

D.   HDD

16.   In an attempt to save disk space, Sean wants to store multiple Windows Server 2012 images in a single .WIM file. Which command should Sean use?

A.   Dism /Append-Image /File:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

B.   Dism /Add-Image /ImageFile:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

C.   Dism /Append-Image /ImageFile:Z:\win10_images.wim /CreateFrom:C:\ /Name:win10_sales

D.   Dism /Append-Image /ImageFile:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

17.   You are planning the use of a new 8TB HDD. Six disk partitions are required for varying file storage uses. How should you initialize the disk?

A.   GPT

B.   MBR

C.   RDP

D.   TCP

18.   Which features do NTFS file systems offer beyond FAT32 file systems? Choose two.

A.   Encryption

B.   Auditing

C.   Imaging

D.   PXE

19.   What benefit does VMFS offer over NTFS?

A.   Encryption

B.   Simultaneous journaling from multiple nodes

C.   Auditing

D.   Simultaneous read/write from multiple nodes

20.   Your server requires storage that will be supplied over the network. What must the storage administrator configure for your server?

A.   NTFS

B.   VMFS

C.   DAS

D.   LUN

Questions and Answers

1.   A new 4TB drive was added to a server, but you notice that the server operating system can use only 2TB. What is the most likely cause of the problem?

A.   The drive was initialized as GPT.

B.   The drive was initialized as MBR.

C.   The operating system has not been updated.

D.   Compression is enabled.

B. MBR-initialized disks have a maximum partition size of 2TB. A, C, and D are incorrect. GPT partitions are not limited to 2TB. Operating system updates do not determine partition size. Compression of the file system would not cause only 2TB to be available.

2.   What hard disk dimension is considered the standard?

A.   1.75-inch

B.   3-inch

C.   5.5-inch

D.   3.5-inch

D. Most hard disk platters have either a 2.5- or 3.5-inch diameter. A, B, and C are incorrect. These are not standard hard disk dimensions.

3.   Which disk speed factor does not apply to SSDs?

A.   IOPS

B.   Capacity

C.   Rotational latency

D.   Transfer rate

C. Rotational latency is related to the amount of time it takes for hard disk platters to spin to the correct position; SSDs do not have spinning platters. A, B, and D are incorrect. IOPS is the number of disk I/O functions that can be performed within 1 second. Capacity is the size of the drive. The transfer rate is a measurement of how quickly data can move into and out of a storage device.

4.   Which disk interface standard is the most common in servers?

A.   SAS

B.   IDE

C.   SATA

D.   EIDE

A. SAS disks are designed to work 24/7 at high speeds, making them well suited for servers. B, C, and D are incorrect. IDE and its successor EIDE are deprecated disk interface standards. SATA is commonly used in desktops and servers, but it is more common on the server side.

5.   Your server environment requires the ability to replace a failed disk while systems remain running. What type of disk system must you use?

A.   Hot-swappable

B.   UEFI

C.   Drive-swappable

D.   RAID

A. Hot-swappable components can be replaced while a system is running. B, C, and D are incorrect. UEFI is a firmware standard that succeeds BIOS. Drive-swappable is a fictitious term. RAID organizes multiple physical disks to work together for fault tolerance and/or performance reasons.

6.   Identify the Windows supported file systems. Choose two.

A.   eFAT

B.   ReFS

C.   XFS

D.   NTFS

B, D. The ReFS file system was introduced with Windows Server 2012 R2 and reduces the amount of file system corruption problems. NTFS is the most common Windows Server file system type; it is a journaled file system that supports additional features such as encryption, file security, compression, and disk quotas. A and C are incorrect. eFAT is a fictitious term. XFS is a file system used by the SGI IRIX operating system and some flavors of Linux.

7.   How does a SAN differ from NAS?

A.   There is no difference.

B.   SANs use IP and NAS does not.

C.   SANs are local server storage and NAS is not.

D.   SANs use specific block I/O protocols and NAS uses standard file-sharing protocols.

D. SANs do not use IP or file-sharing protocols; instead, they use block I/O protocols such as Fibre Channel. A, B, and C are incorrect. SANs and NAS are not the same. NAS uses standard file-sharing protocols such as SMB and NFS. SAN solutions do not use IP and they are not considered local storage; instead, they are considered network storage.

8.   One of your locations is using iSCSI for server network storage. You want to ensure that regular TCP/IP traffic does not impede iSCSI performance. What should you do?

A.   Use a separate VLAN for iSCSI.

B.   Configure LUN masking.

C.   Configure LUN zoning.

D.   Enable iSCSI CHAP authentication.

A. VLANs can be used to isolate one type of network traffic from another for performance reasons. Placing iSCSI traffic on its own VLAN accomplishes this. B, C, and D are incorrect. LUN masking and zoning are used to control host access to network storage. iSCSI CHAP is indeed used for authenticating initiators to targets, but it is not related to improving network performance.

9.   Which statement regarding software iSCSI initiators is true?

A.   Targets are accessible only through FC switches.

B.   They do not support OS booting from SAN.

C.   IPv6 must be configured.

D.   iSCSI targets must reside on the same subnet with iSCSI initiators.

B. Software iSCSI initiators can be used only when the operating system is already running; therefore, SAN booting using this solution is not possible. A, C, and D are incorrect. iSCSI does not require FC switches; standard Ethernet equipment works just fine. IPv6 is not required for iSCSI; IPv4 works well. Initiators and targets do not have to reside on the same subnet.

10.   Your boss has asked you to determine what equipment must be ordered to set up a new FCoE environment. Which FCoE item is required?

A.   NAS device

B.   CNA

C.   UEFI

D.   RAID controller

B. CNAs combine FCoE and NIC functionality; each host needing access to network storage requires a CNA. A, C, and D are incorrect. NAS devices provide access to network storage using file-sharing protocols such as NFS and SMB; this is not required with FCoE. UEFI is a firmware standard that succeeds BIOS. RAID controllers can group multiple physical disks together for fault tolerance and/or performance reasons, but this is not FCoE-specific equipment.

11.   You are a Linux server administrator. To plan future disk space requirements, you would like to track user disk space consumption. What should you configure?

A.   Hard quotas

B.   GPT

C.   NTFS

D.   Soft quotas

D. Soft quotas can log the fact that disk space thresholds have been exceeded. A, B, and C are incorrect. Hard quotas actually prevent additional files from being stored on a server once the quota is reached, so they aren’t as useful as soft quotas for tracking purposes. GPT is a newer disk partitioning scheme that supersedes MBR and allows for a larger number and capacity for partitions. NTFS is a common Windows file system standard that supports features such as file encryption, compression, auditing, and disk quotas.

12.   As you configure three new server disk volumes, you are unsure as to how large each volume should be. What should you configure?

A.   Thin provisioning

B.   Thick provisioning

C.   RAID 0

D.   RAID 1

A. Thin provisioning enables administrators to set a disk volume to grow to a maximum size if required, but the space is not allocated in its entirety, thereby allowing other thinly provisioned disk volumes to consume that same space as needed. B, C, and D are incorrect. Thick provisioning allocates disk volume space immediately and therefore cannot share that space simultaneously with other disk volumes. RAID 0, disk striping, is used to improve disk I/O performance. RAID 1, disk mirroring, is used for redundancy in case one disk fails.

13.   Which RAID level offers the best performance?

A.   RAID 0

B.   RAID 1

C.   RAID 2

D.   RAID 3

A. RAID 0, disk striping, groups multiple physical disks together for disk I/O. When writing data to the RAID 0 array, the data is broken into blocks (stripes), each of which is concurrently written to a physical disk in the array, thus resulting in improved performance. B, C, and D are incorrect. RAID 1, disk mirroring, is used for fault tolerance. A disk write to one disk is duplicated on another disk. When one disk fails, the other has an up-to-date copy of the data. RAID 2 stripes bits of data but still writes error recovery information. RAID 3 stripes bytes of data but still uses a dedicated parity disk for error recovery.

14.   Which type of storage would be considered Tier 2 storage?

A.   SCSI

B.   IDE

C.   SSD

D.   HDD

D. Hard disk drives are considered Tier 2 storage. A, B, and C are incorrect. SCSI and IDE are disk interfaces that are not organized into storage tiers. SSD would be considered Tier 1 storage.

15.   Which type of storage combines disk platters with flash memory?

A.   SSHD

B.   SSD

C.   HHDD

D.   HDD

A. Solid-state hybrid drives combine flash memory with disk platters. B, C, and D are incorrect. SSDs are flash memory only. HHDD is a fictitious acronym. HDDs are disk platters only.

16.   In an attempt to save disk space, Sean wants to store multiple Windows Server 2012 images in a single .WIM file. Which command should Sean use?

A.   Dism /Append-Image /File:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

B.   Dism /Add-Image /ImageFile:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

C.   Dism /Append-Image /ImageFile:Z:\win10_images.wim /CreateFrom:C:\ /Name:win10_sales

D.   Dism /Append-Image /ImageFile:Z:\win10_images.wim /CaptureDir:C:\ /Name:win10_sales

D. The /Append-Image switch adds images to a single .WIM file. A, B, and C are incorrect. There is no /File, /Add-Image, or /CreateFrom switch for the dism command.

17.   You are planning the use of a new 8TB HDD. Six disk partitions are required for varying file storage uses. How should you initialize the disk?

A.   GPT

B.   MBR

C.   RDP

D.   TCP

A. GPT allows more than four disk partitions. B, C, and D are incorrect. MBR allows up to a maximum of four partitions. RDP, the Remote Desktop Protocol, is used to connect to a Windows computer over a network; it is not related to storage, nor is TCP. TCP is the Transmission Control Protocol; it is a reliable connect-oriented transport protocol within the TCP/IP suite.

18.   Which features do NTFS file systems offer beyond FAT32 file systems? Choose two.

A.   Encryption

B.   Auditing

C.   Imaging

D.   PXE

A, B. NTFS file systems support encryption and auditing, which are not supported with FAT32 file systems. C and D are incorrect. Imaging and PXE are not file system features. Imaging is a convenient way of deploying operating systems without performing a manual installation. PXE enables booting over the network instead of from local media and is normally used for imaging operations.

19.   What benefit does VMFS offer over NTFS?

A.   Encryption

B.   Simultaneous journaling from multiple nodes

C.   Auditing

D.   Simultaneous read/write from multiple nodes

D. VMware’s VMFS is designed to enable multiple cluster nodes to read and write to the same file system at the same time. A, B, and C are incorrect. Encryption and auditing are available with NTFS file systems. Simultaneous journaling is not a valid feature.

20.   Your server requires storage that will be supplied over the network. What must the storage administrator configure for your server?

A.   NTFS

B.   VMFS

C.   DAS

D.   LUN

D. A logical unit number is a unit of disk space with a unique ID that is prepared by a storage administrator for use by a specific server. A, B, and C are incorrect. NTFS and VMFS are file systems that are not required for network storage. DAS refers to direct-attached, or local server, storage.

CHAPTER 5

Server Network Communications

In this chapter, you will

•   Learn about the OSI model

•   Identify proper cable installation and management techniques

•   Recognize the role of network interface cards, switches, and routers

•   Learn how to configure IPv4 and IPv6, including subnetting

•   Understand TCP and UDP port numbers

•   Identify network infrastructure services, including DHCP, DNS, and WINS

Every server technician is exposed to networking at the hardware and software levels at some point in time. You may not be the network infrastructure expert in your organization, but your servers will interface with the network infrastructure in various ways. The TCP/IP protocol suite has long been used on corporate networks as well as the Internet. As such, Server+ candidates are required to have a solid understanding of both IPv4 and IPv6.

The OSI Model

Telephony and network communications involve both hardware and software components. The Open Systems Interconnection (OSI) model is a widely accepted seven-layer approach to mapping and explaining these components. The IT industry will often refer to “Layer 3 switches,” “Layer 7 firewalls,” “Layer 2 addresses,” and so on.

The OSI layers are not tangible or visible in any way; they are a concept, albeit an important one. Not all layers need to be involved in the transmission and receipt of data between two devices, and not all network protocols map cleanly to OSI layers.

Here are the seven layers of the OSI model:

•   Layer 7  Application layer

•   Layer 6  Presentation layer

•   Layer 5  Session layer

•   Layer 4  Transport layer

•   Layer 3  Network layer

•   Layer 2  Data link layer

•   Layer 1  Physical layer

One way to remember the seven layers, starting from the top, is by using a mnemonic: “All People Seem To Need Data Processing.” Table 5-1 explains the characteristics of each layer.

Table 5-1  OSI Layers

Let’s apply the OSI model to the action of viewing a secured web site (HTTPS) using a web browser. Bear in mind that not all protocols such as Transport Layer Security (TLS) fit cleanly into individual OSI layers.

1.   The user enters an HTTPS Uniform Resource Locator (URL) into the address line of a web browser. The application layer (7) is involved at this point.

2.   Because an HTTPS connection is being used, the presentation layer (6) is involved due to encryption. TLS is commonly used as the network security protocol instead of the deprecated Secure Sockets Layer (SSL) protocol.

3.   HTTPS establishes a session with the receiving host before transmitting data, so the session layer (5) is used here.

4.   TCP is a transport layer (4) protocol. Layer 4 addresses are port addresses; HTTPS web servers normally listen for client connections on TCP port 443.

5.   If the client and server are on different networks, a router gets involved. Routers are Layer 3 (the network layer) devices. IP addresses would still be involved even on the same network, and IP addresses are Layer 3 addresses.

6.   On the LAN, Media Access Control (MAC) addresses (hardware addresses) are used. This applies to the data link layer (2), as does the specific mechanism for gaining access to the transmission medium.

7.   Finally, the physical layer (1) is involved whether a wired or wireless connection is used for connectivity.

8.   The same type of activity takes place on the other end of the connection, but instead it moves up the applicable layers of the OSI model.

Cable Installation and Management

Wireless networking in the form of cellular 4G, 5G, and Wi-Fi communications has exploded in popularity for user devices. But for servers and infrastructure equipment in the enterprise, data center, and server room, wired networking is more common than wireless. Many organizations use a hybrid of both wired and wireless communications, and these apply to the physical layer (1) of the OSI model.

Cable Placement

Large server rooms and data centers use racks to mount equipment—but what about all the power and data cables? Power cables for equipment are normally located in the back of the rack, as are network cables for servers, storage arrays, KVM (keyboard, video, mouse) switches, and the like. Cable management arms can be used to organize cables for rack-mounted devices. As the rack-mounted device is slid out on a rail, the arm containing the cables expands, so we don’t have to worry about cables being pulled tight.

In the case of rack-mounted network switches and similar equipment, network cables are plugged into ports on the front of the equipment. Either way, we need an organized way to channel these bundles of cables both horizontally and vertically using cable management trays or channels built into the rack.

Plastic cable ties and hook-and-loop fasteners can be used to keep bundles of network cables together. These bundles are fed into cable channels, which can be built into racks or added to existing racks. The cable channels can also extend from racks to other locations in the server room or data center as required.

CAUTION   Cable channel placement, especially near ceilings, must be carefully planned. You don’t want thick bundles of cables and cable trays hampering the effectiveness of fire suppression systems or airflow mechanisms.

Cable Labeling

Most people like spaghetti, but not in server rooms. Dealing with bundles of unlabeled knots of network cables is not so great; check out Figure 5-1 to see what I mean. Have you ever had to trace network cables in a server room or wiring closet? It can go one of two ways:

Figure 5-1  A mess of network cables

•   A good experience because of labeling and proper cable management

•   A frustrating experience because of a snake pit of tangled cables

Network wall jacks, as well as the other end of the cable on the patch panel in the server room or wiring closet, need to be correctly labeled. From the patch panel, shorter network cables are plugged into network equipment such as Ethernet switch ports. These patch cables also must be correctly labeled.

You must establish and follow a labeling standard. Using things such as IP addresses or computer names for labeling isn’t a great idea, because they are both easily changed. You might use a wall-jack labeling scheme or a location-based scheme (Floor 9, Room 2, Jack 1 might become f9r2j1). Or you might simply use incrementing numbers (jack1, jack2, jack3, and so on). Printing these values on small stickers or cable labels makes your life much easier when you’re tracing cables and troubleshooting. Recording this on a network or building map can also be helpful. Color-coded cables can also make your life easier. For example, you could establish a standard that cables plugged into infrastructure equipment such as switches and routers will all be colored orange.

Cable Types

There are many different types of network cables, but regardless of your choice, cables must be properly organized and labeled. When you’re routing cables around corners, make sure you don’t exceed the cable bend radius, which determines the degree to which you can bend a cable without damaging the wires inside it. For example, for CAT5 and CAT6 network cables, the bend radius is four times the diameter of the cable—this works out to be about 1 inch. Fiber-optic cables, on the other hand, have a bend radius of about 2 inches.

Several questions need to be addressed to determine cable selection criteria, including the following:

•   What type of connectors does our equipment support?

•   Over what distance must the transmission travel?

•   Could electromagnetic interference (EMI) be a problem?

•   Can eavesdropping be a problem for cable transmissions?

Copper Cables

Copper cables contain copper wires that transmit electrical signals. Shielded twisted pair (STP) and unshielded twisted pair (UTP) cables contain eight copper wires grouped into four pairs. Each pair of wires is twisted at a specific rate to reduce crosstalk interference from adjacent wires. The higher the transmission rate (higher frequencies), the greater the number of twists per inch. Figure 5-2 shows a UTP cable.

Figure 5-2  UTP cable with RJ-45 connector

NOTE   Network cables alone do not determine how quickly data is transmitted. Other factors, including network card and switch port configuration, as well as distance covered, greatly influence network speeds.

STP cables have a shielding layer that sends interfering electronic signals to a ground wire that protects signals being transmitted within the cable. UTP does not have a shielding layer so it is more susceptible to EMI produced from objects such as machinery in a manufacturing plant.

Copper Cable Connectors  RJ-11 connectors are used for standard four-wire telephone cables. RJ-45 connectors are used for UTP and STP cables. These connectors are plastic with tiny metal plates that connect to the copper wires in the cable, thus allowing for electrical conductivity when plugged into an RJ-11 or RJ-45 socket. RJ-45 connectors are shown in Figure 5-3.

Figure 5-3  RJ-45 connectors

Modern office phone systems use the Voice over Internet Protocol (VoIP), where each phone is a node on the network with a unique IP address. Older office phone systems used physical private branch exchange (PBX) devices or PBX virtual machine appliances. PBX is used for internal office phone systems; you can configure extension numbers (the office would need only a single public telephone number), hold music, voicemail settings, call forwarding, and a full complement of telephony options. Back in the day, RJ-11 connectors linked office phones to the PBX.

Common Copper Cable Uses  When the eight copper wires in a network cable are in the same position at both ends (the pin 1 wire on one end corresponds to pin 1 on the other end of the cable), we have a straight-through cable. This is the most common type of copper-based network cable; we use it to plug stations into network wall jacks, to connect patch panel connections to switch ports, and to interconnect network infrastructure equipment such as switches.

Crossover cables reverse the receive and transmit wires on each end of the cable. We can use this to plug stations directly into each other without a switch, or, if required, we can use these to link equipment together such as switches. Most modern network switches don’t require crossover cables; they can automatically detect whether a straight-through cable is being used and properly match the other end of the link.

Rollover cables are used for administrators to connect locally to network equipment such as the console port on a router. These are easy to identify: the cable is flat and is normally light blue in color. But don’t depend on cable color to indicate the cable type; instead, look at the connectors and the wire-to-pin layout in the connector.

CAT5, CAT5e, CAT6  Copper cable categories are distinguished from one another by the transmission speeds they can accommodate at higher frequencies. This is accomplished by increasing the number of twists per inch for each wire pair. So the CAT5 network cable standard has more twists per inch than a CAT3 cable, which means CAT5 can transmit data at a much higher rate than CAT3. Remember that network cards and network equipment also factor into transmission speeds.

Copper network cables generally have a maximum transmission distance of 100 meters (328 feet), after which the signal degrades significantly. (You can multiply meters by 3 to get an approximation of the distance in feet.) Repeaters can be placed at every 100 meters to extend the distance of the network. A network switch or router can be used as a repeater. Table 5-2 shows the differences between copper cable types. Unless otherwise stated, it is understood that 100 meters is the maximum distance.

Table 5-2  Copper Cable Categories

NOTE   Newer copper cable standards will work with older network equipment. This is useful when you’re upgrading cabling before upgrading equipment. The only issue is whether or not the existing equipment can transmit or receive at the rated speeds for the cable standard.

Fiber-optic Cables

Fiber-optic cables transmit light instead of electrical signals, so they are not susceptible at all to EMI. You need special network cards and equipment to transmit and receive data over fiber-optic.

Contrary to popular belief, the term “fiber-optic” does not always means faster transmission rates, although many vendors market it this way, such as FibreOP for the home. Fiber-optic cables enable signals to travel longer distances than their electrical counterparts because light can travel much farther than electrical signals before the signal degrades. For example, where twisted pair copper network cables generally max out at 100 meters, fiber-optic can travel hundreds of kilometers. Figure 5-4 shows a fiber-optic cable.

Figure 5-4  Fiber-optic cable with straight-tip connectors

Each individual glass or plastic core fiber in the cable can carry different light wavelengths, which means it can carry multiple signals over different channels. This is often used on service provider backbones and requires optical multiplexer and demultiplexing equipment.

Fiber-optic offers benefits such as the following:

•   Multiple channels carried in a single fiber rather than requiring many copper network cables

•   Not susceptible to EMI

•   Lightweight, so it works well in places such as aircraft

•   No possibility of sparks, so it’s good in explosive environments

•   Difficult to eavesdrop (wiretap)

Fiber-optic cabling usage is not quite ubiquitous with desktop computer connectivity because of its cost, but it is commonly used for server networks and internetwork connections.

There are two general types of fiber-optic cabling: single-mode and multi-mode. Single-mode fiber (SMF) has a smaller diameter (less than 10 micrometers) than multi-mode fiber (MMF), about 50 micrometers in diameter. SMF supports greater distances, but this means that SMF is more expensive than MMF, which is useful for distances of less than 2 kilometers (1.2 miles). Bear in mind that a single fiber-optic cable could consist of more than one SMF core.

NOTE   Imagine the great distance covered using submarine fiber-optic cables linking Halifax, Nova Scotia, to Dublin, Ireland—we’re talking 12,000 kilometers, or 7400 miles! Check out www.submarinecablemap.com/ to see undersea fiber links around the planet.

Fiber-optic Connectors  Just as copper cables have their specific connectors, so, too, do fiber-optic cables. Table 5-3 lists common fiber-optic connectors, but bear in mind that SFP, SFP+, and QSFP (listed in the table) also support connections to copper cables.

Table 5-3  Common Fiber-optic Cable Connectors

Network Hardware

It takes varying pieces of network equipment working together to result in a functioning network infrastructure. This section gets into network interface cards, network switches, and routers.

Network Interface Cards

Network cables have connectors that are supposed to plug into something, and one of those items is a network interface card (NIC). Most modern computers have a wired NIC embedded on the motherboard; servers, including blade servers, often have multiple onboard NICs. Some blade server models enable a daughter circuit board (a NIC) to be plugged into the blade server motherboard.

You must carefully choose NICs to support your needs, which may include the following:

•   Supports your network topology such as Ethernet, IEEE 802.11 wireless

•   Includes the correct connector sockets such as RJ-45, fiber ST, SFP

•   Supports the correct speeds such as1 Gbps, 10 Gbps Ethernet

MAC Address

All network cards have a unique 48-bit hexadecimal hardware address, also called a physical address or Media Access Control (MAC) address. Whether we work with Bluetooth or Wi-Fi wireless NICs or a wired Ethernet NIC, they all have a MAC address, which looks something like this: 90-48-9A-11-BD-6F.

NOTE   On a Windows system, you can see the MAC address for your network interface(s) by typing ipconfig /all. On Linux, type ifconfig.

The MAC address is a hardware-unique identifier used only on the LAN. So, for instance, when you connect to an Internet web server, your machine must know the web server’s IP address, but it’s not concerned with the web server’s MAC address. You might wonder what role the MAC address then plays; in our example, your machine must know the MAC address of the router, or default gateway, to get traffic out of the LAN.

MAC addresses can also be used to control connections. One great example of this is MAC address filtering at the switch port level or with a wireless router; if your MAC address is not on the “allowed” list, you can’t connect. However, MAC addresses can be spoofed, or forged, so don’t rely solely on MAC address filters for security. MAC addresses are also called Layer 2 addresses.

Common NIC Features

Modern desktop and server motherboards often have integrated network cards. You can configure a series of options depending on how you plan on using the cards.

Wake-on-LAN  One common NIC feature is Wake-on-LAN (WoL). WoL must also be supported by the BIOS or Unified Extensible Firmware Interface (UEFI). It enables a powered-down system to still feed enough power to the NIC so that it can be woken up remotely with a specially crafted packet. Although this can work well for desktops that you want to push updates to in the middle of the night, servers are generally left on all the time.

PXE  The Preboot Execution Environment (PXE) NIC feature works with the BIOS or UEFI boot sequence to enable network boot. This means that instead of starting an operating system from a local disk, a small operating system image gets pulled across the network from a PXE boot server to local RAM. PXE boot works best with Dynamic Host Configuration Protocol (DHCP) to assign IP settings dynamically to PXE boot clients, and this is common as a server network imaging solution.

NIC Teaming  NIC teaming is used to group multiple NICs together, similar to grouping multiple disks together in a RAID array. A NIC team can be used to aggregate the bandwidth of multiple NICs together for better performance, or it can be used for communications redundancy in case one NIC fails. You may encounter vendor terms such as “NIC bonding” or “NIC balancing”; it all falls under the same umbrella.

NIC teaming can be a function of a server operating system (such as Windows Server) and/or the network switch. NIC teaming configuration on the Windows platform is shown in Figure 5-5. If you were to configure NIC teaming for bandwidth aggregation in an operating system, network traffic leaving the server could take advantage of this feature, but not inbound traffic (how would the sending station or switch know about the NIC teaming?). You may have to involve your switch administrator to configure switch port aggregation for the switch ports your server NICs are plugged into.

Figure 5-5  Adding NICs to a NIC team using Windows Server

Network Switches

For wired networks, most modern network equipment uses twisted pair cabling to plug devices into wall jacks, which in turn use short patch cables to plug into switch ports in a wiring closet or server room.

For very small networks, a 4-port switch might do the trick. In larger networks, multiple 24-port switches may be linked (trunked) together to accommodate large numbers of devices. With most modern switches, a standard twisted pair straight-through cable can be used to link switches together, although you may come across some that require a crossover cable (receive and transmit wires are reversed on either end of the cable). Higher end switches will use fiber-optic cabling to link together, or trunk, switches through fiber or SFP ports.

VLANs

By default, all physical switch ports are configured within the same virtual local area network (VLAN). A VLAN is a way of grouping devices together so that they can communicate as if they were on the same physical LAN. A router is needed for devices on different VLANs to communicate. Layer 3 switches have built-in routing capabilities, so it’s convenient to configure inter-VLAN routing using a single device.

A VLAN may simply group physical switch ports together. For example, switch ports 1–12 may be called VLAN1 and switch ports 13–24 may be called VLAN2. Even though all ports are physically on the same switch, without a router, a device on VLAN1 will not be able to communicate with a device on VLAN2.

Another way to create a VLAN is by having the switch examine the IP address of the device plugged into the port. For example, regardless of physical port, devices plugged into the switch with a network prefix of 172.16.0.0 would be considered to be on the same VLAN, so they can talk to each other without requiring a router.

Switch administrators can also control VLAN membership by MAC address, by protocol used on the client device, and by higher level applications in use. So a device with a MAC address of 90-48-9A-11-BD-6F could be configured to be in VLAN1. As another example, devices using File Transfer Protocol (FTP) could be grouped together into their own VLAN.

Network people normally configure VLANs to improve network efficiency. Having a number of devices that talk frequently on their own small network instead of everybody on a large network makes sense. Creating a VLAN creates a new broadcast domain. Broadcasts are network transmissions addressed to all devices on the network; they don’t cross VLANs, so multiple VLANs can reduce traffic overall.

Another primary reason for multiple VLANs is security; accounting devices may be placed on a separate VLAN from the rest of the network, for example.

Layer 2 and Layer 3 Switches

Most switches are Layer 2 devices because they work with MAC addresses. Higher end switches will have IP routing capabilities and are Layer 3 switches.

A switch has its own memory, where it tracks which device MAC addresses are plugged into its ports. This is done so that, instead of broadcasting transmissions to every port (like a hub does) to find a specific MAC address, it simply consults its MAC address table in memory. This reduces network chatter and essentially creates a collision domain for each switch port. Why does this matter? Unlike a hub, switches enable multiple concurrent network conversations.

The cheapest, least functional switches are not manageable. This means you supply power to the switch, plug devices into the switch ports, and that’s it—you can’t configure it any further, and you certainly can’t connect to it over the network for management purposes. Figure 5-6 shows a UTP cable with RJ-45 connector plugged into a switch port. Most enterprises use managed switches that are assigned a valid IP configuration so that various remote management tools such as web browsers and SSH can be used by administrators to connect remotely over the network.

Figure 5-6  A UTP cable plugged into an Ethernet switch port

The following list includes common items you could configure on a switch:

•   Port duplex mode and speed

•   VLANs

•   Disabled (unused) switch ports

•   TCP/IP settings (for managed switches)

•   Port aggregation (for NIC teaming)

•   Port multicast support

Routers

Routers have at least two interfaces that interconnect networks. A large company may use dozens of routers to interconnect its internal networks. The Internet, in fact, consists of millions of interconnected routers.

A router has memory that stores routing tables. Routers use routing protocols such as Routing Information Protocol (RIP) and Open Shortest Path First (OSPF) to exchange routing information with one another.

To look up the best way to send packets to a remote network, routers consult their routing tables, which include information about other IP networks and characteristics (routing metrics) such as the route cost, how many hops (routers) the packet would have to go through before arriving at its destination, and other details.

Because it deals with IP addresses and transferring network traffic to remote networks, a router is said to be a Layer 3 device. Remember that Layer 3 of the OSI model is the network layer.

Figure 5-7 shows a router with three interfaces. Interface 0 is public-facing with a connection to the Internet. Interfaces 1 and 2 each connect to a separate internal network switch where other network devices such as printers, desktops, and servers would be plugged in. Each router interface must be configured with the correct TCP/IP settings.

Figure 5-7  A simple network infrastructure

Configuring IPv4

We all know how old-school telephones work. With a local number, the first three numbers identify the local exchange or central office, and the last four numbers identify a specific telephone. IP addresses work similarly, where a single IP address consists of both a network and node (host) portion.

For communication on today’s enterprise networks (and the Internet), devices must have a unique IP address—unique, at least, on their LAN or subnet. Have you ever wondered why, for example, you can use an IP address of 192.168.1.100 on your home network, and your friend on her home network can use the same IP address? How does that work if you can both get on the Internet? The answer is Port Address Translation (PAT).

PAT

Port Address Translation enables many internal IP addresses to connect through a PAT router to the Internet using a single public IP address (the one assigned to the public interface of the PAT router). The PAT router uses a unique source port number from the internal sending machine to track external connections and their responses. This works well to get a bunch of internal devices on the Internet with a single public IP address. When most people refer to NAT, they’re really talking about PAT.

You can check out your Internet IP address from home or work on different devices (including smartphones and tablets) by visiting www.whatismyip.com. You’ll see that all your internal devices appear to be coming from the same IP address. Figure 5-8 illustrates how many internal IP addresses can get to the Internet using a single public IP address by tracking port numbers.

Figure 5-8  PAT router port table

Static NAT

Static NAT maps external IP addresses on the NAT router to corresponding internal IP addresses for devices on the internal network. This is useful when you want to allow inbound connections to hosts on a private network through a NAT router while hiding the true internal IP addresses of those hosts. So there is a 1:1 correlation between external and internal IP addresses.

IP

The Internet Protocol (IP) is a big deal. We hear about it all the time at work and in the media when the latest Internet hack spreads like wildfire. It is the specific TCP/IP protocol that enables traffic to shoot around the Internet, and it applies to Layer 3 of the OSI model.

Devices that want to communicate on a TCP/IP network must have a valid IP address (among other things), but IP is also responsible for routing packets to different networks all over the planet. Routers look at IP addresses to determine the best way to get traffic to a remote network efficiently. This applies to both IPv4 and the newer IPv6.

IPv4 Addressing

The swinging 1960s led to the initial development of standards for linking computers together, including software network communications protocols. This led to the creation of the ARPANET in October 1967, which was funded by the US government, but designed and implemented by various research and academic folks. Depending on which folks you talk to, either those who were involved in the research funding or those involved in the actual research and implementation of the ARPANET—you’ll get a different explanation as to why the ARPANET was created. The designers will say it was created to enable a sharing network with no central authority, while U.S. government officials who signed the checks will say it was to create a distributed network that could still function in the event of a nuclear attack. Either way, we’re all grateful that the ARPANET evolved into the Internet that we all know and love today!

An IPv4 address is 32 bits long, but most of us are used to seeing it expressed in decimal with a period separating each 8-bit group, such as 192.168.1.1, the binary equivalent of which is 11000000 10101000 00000001 0000001. Each grouping of 8 bits is called a byte or octet.

Since we’re working with binary 0’s and 1’s, the smallest possible value for an octet is 0 (00000000 in binary) and the largest is 255 (11111111 in binary), so you’ll never see an IPv4 address like 267.3.52.378—mathematically, it’s not possible. IP addresses are also referred to as Layer 3 addresses.

NOTE   Many organizations use specific internal IP ranges for certain types of devices. For instance, servers may always be configured in the 200 to 210 host range, and network printers may be in the 220 to 230 host range. So if your IPv4 network prefix is 192.168.1, the first server IP address would be 192.168.1.200 and the first network printer IP address would be 192.168.1.220.

Subnet Mask

Earlier in the section we stated that a single IP address consists of both network and node (host) portions. The subnet mask defines this. For example, consider the following:

IP address: 192.168.1.1

Subnet mask: 255.255.255.0

The first octet of the subnet mask (255) means all of the binary bits are set to 1’s. This means this entire octet identifies a part of our network; the same is true for the next two octets. The result in this example is that the first three octets identify the network that the device is a member of, which is 192.168.1.0/24. A trailing 0 is normally used to identify a network address. The /24 (which is called CIDR, Classless Inter-Domain Routing, notation) means there are 24 binary 1 bits in the subnet mask, so /24 and 255.255.255.0 have the same meaning. That leaves us with one octet (the fourth octet) to address devices, or hosts, on the 192.168.1.0 network. The device address in this example is simply 1.

NOTE   Many a wireless router has its internal WLAN IP address set to 192.168.1.1. In this case, either start using addresses from 192.168.1.2 onward or reconfigure the IP address of the wireless router.

Reserved Internal IP Address Ranges

The address 127.0.0.1 is a reserved local loopback address used for testing, but there are entire ranges of IP addresses designed for internal use on enterprise networks. These private IP address ranges are defined in RFC 1918 (https://tools.ietf.org/html/rfc1918). Internet routers don’t forward this type of traffic, but your organization’s internal routers can. The address ranges follow:

•   10.0.0.0–10.255.255.255

•   172.16.0.0–172.31.255.255

•   192.168.0.0–192.168.255.255

Public unique IP addresses are allocated by your Internet service provider (ISP), and depending on your needs, you could have only one or dozens of them. If, for instance, you wanted to host your own public web site on your own network, you would need a unique public IP address (and DNS name too).

An example of a public IPv4 address is 199.126.129.77. IP addresses can be configured manually, as shown in Figure 5-9. With IPv4, there is a shortage of addresses. Mathematically, 232 equals 4 billion and change. In other words, there are around 4 billion unique IPv4 addresses possible. This is where PAT, NAT, and IPv6 come in.

Figure 5-9  Manual configuring of IPv4 settings in Windows

When to Use Subnetting

There are times when you’ll have a single IP network address but more than one network to allocate IP addresses to. Other than acquiring additional network addresses, you can opt to subnet.

Subnetting takes an existing network address and subdivides it into subnetworks, or subnets, to enable communication between devices on the various subnets. But where do you configure this? On the router? On each device? The answer to all is “yes.” Subnetting is implemented in the IP addressing and subnet mask configured on all affected devices. We need an example.

NOTE   I’ve run into plenty of IT people who state they don’t need to bother learning anything about subnetting, especially with the advent of PAT. I disagree, certainly for the purposes of the Server+ SK0-005 exam! It’s like a professional carpenter stating that he or she doesn’t have to understand trigonometry. So let’s get started with the trig!

The Sample Scenario

You are a network specialist. Your organization’s ISP has provided the company with a single network address of 200.200.1.0/24. From the /24, you know you have 24 out of 32 enabled (turned on) bits in the subnet mask, stated otherwise as 255.255.255.0. So you have one octet, the last one (8 bits), to work with to address subnets and hosts on those subnets.

The Problem

You have one IP network address, but your public-facing router is connected to four separate networks that need public-facing addresses. The company cannot afford to acquire four additional public IP network ranges.

The Solution

You will subnet. This is done by using host bits so that you can address your subnets. Remember, in this example you have 8 bits to play with in the last octet. But how many bits of the 8 must you use to address four additional subnets?

How Many Bits?  Use the formula 2number of borrowed host bits. The 2 is used since you’re working in binary (0’s and 1’s); there are only two possible values. The number of borrowed host bits is how many bits, starting from the left, from the host portion of a network address you may need to use so that you can address your subnets.

If you calculate 21, you end up with 2. This means you could have two unique subnet addresses, but in this scenario you need four unique subnet addresses. If you calculate 22, you end up with 4. So it’s settled. You will be borrowing 2 host bits.

The New Subnet Mask  This means everybody’s subnet mask will change from /24 to /26 when expressed in CIDR notation, because you are now using an additional 2 bits to address your subnets. Expressed in decimal, this means you go from a subnet mask of 255.255.255.0 to 255.255.255.192. It’s 192 because in binary, the last octet is now 11000000 because the first 2 bits of this octet will be used to address subnets themselves. Converted to decimal, this is 192. Now you have only 6 bits to address devices on each subnet. Without subnetting, you would have the original 8 bits in the last octet to address devices on the single network.

Subnet Addresses  Next you have to come up with valid subnet IDs. There are plenty of ways to do this, including web sites that will calculate subnet and host addresses for you. For learning purposes, we’ll figure this out the manual way. To do this, we will map the last octet (in our specific case) manually to a binary conversion table. (I would recommend committing it to memory, because it will help with this kind of stuff.) Start the table headings with 128 and keep cutting it in half until you get to 1. Then plot your binary 8 bits into the table underneath the headings. Here’s the table:

Look at the right-most binary 1. It falls under 64, so 64 is the mathematical value you will use to determine other subnet addresses. So the subnet addresses are 0, 64, 128, and 192 (keep adding 64). To illustrate this further, look at all possible subnet address combinations when using 2 bits for subnetting:

0 0 = Subnet 0

0 1 = Subnet 64

1 0 = Subnet 128

1 1 = Subnet 192

•   Your first subnet address is 200.200.1.0/26.

•   Your second subnet address is 200.200.1.64/26.

•   Your third subnet address is 200.200.1.128/26.

•   Your fourth subnet address is 200.200.1.192/26.

Subnet IP Ranges  You’re using 2 of 8 bits in the last octet to address four subnets, which leaves 6 bits to address hosts on each of the four subnets. You can calculate 26 to determine the number of IP addresses per subnet, which results in 64, but you must subtract two potential host IP addresses that are not allowed. The host portion of a configured IP address (6 bits in this case) cannot be all 0’s or all 1’s. So to determine the usable IP addresses per subnet, the calculation in this case is 26 – 2, which equals 62. And 62 × 4 equals 248, so we have a total of 248 unique IP addresses across all four subnets. Each of our four subnets can use a maximum of 62 unique IP addresses.

Your first subnet address value is 0 and the next is 64. Since 0 identifies the subnet itself, you can’t use 0 (200.1.1.0) as a host IP address. Remember, all host bits cannot be 0’s. Instead, you start at 1 (200.1.1.1) as the first valid IP address on subnet 0.

The last valid IP address on subnet 0 is 62. You can’t use 64 because it identifies the second subnet, and 63 is the broadcast address for subnet 0, so it’s off limits. The number 63 in binary is 0011 1111. The first two 0’s identify subnet 0. When all bits on a network address are set to 1’s, it is the broadcast address for that subnet and cannot be assigned to a host.

Here are the valid IP address ranges for subnets 0, 64, 128 and 192:

•   Subnet 0: 200.1.1.1–200.1.1.62

•   Subnet 64: 200.1.1.65–200.1.1.126

•   Subnet 128: 200.1.1.129–200.1.1.190

•   Subnet 192: 200.1.1.193–200.1.1.254

Remember that some of those IPs need to be assigned to the appropriate router interface connected to each network—and everybody gets configured with the 255.255.255.192 subnet mask. Subnetting can be useful for addressing on VLANs. One way a switch administrator creates a VLAN is to group physical switch ports into their own network (a VLAN). Yet another method is to group devices into a VLAN (regardless of physical switch port) based on their IP address. You may want VLANs to isolate network traffic for performance or security reasons.

Configuring IPv6

IPv6, unlike IPv4, was designed with the knowledge of how the world’s computing devices are interconnected. IPv6 is different from IPv4 in many ways, including the fact that broadcasts are not used; instead, there is a heavy reliance on multicasting. On the security side, IP Security (IPSec) support is required for IPv6 implementations. IPSec can encrypt and sign network transmissions and can also be used with IPv4.

Software broadcasts don’t exist with IPv6 like they do with IPv4. Unicast transmissions (from one sender to one target), multicast transmissions (from one sender to a group of devices registered with a multicast listening address), and anycast transmissions are used instead. The same anycast address can be configured on many network devices. Anycast traffic is sent to the nearest device interface configured with the anycast address.

IPv6 Addressing

Here’s the biggest change: where the IPv4 address space consists of 32 bits, IPv6 uses 128 bits, so it is four times larger! Let’s do the math:

•   IPv4: 232 = 4,294,967,296

•   IPv6: 2128 = 340,282,366,920,938,463,463,374,607,431,768,211,456

IPv4 has about 4 billion different IP addresses, and IPv6 has 340 undecillion! Instead of expressing the address in decimal form (such as is the case with IPv4), IPv6 addresses are expressed in hexadecimal. Hex is base 16; we use numbers 0–9 and letters A–F, where A = 10, B = 11, C = 12, D = 13, E = 14, and F = 15.

Each of the eight parts of an IPv6 address is 16 bits long (a hextet), and, of course, 8 × 16 = 128. Instead of separating each hextet with a period, a full colon is used. Consider the following IPv6 address:

fe80::883b:ced4:63f3:f297%8

Notice the two full colons together. This can be used once in an IPv6 address. It represents a series of 0’s, which is really the absence of a value. Also take note of the %8 at the end. This is a network interface identifier. The IPv6 local loopback address for testing is simply ::1.

The preceding IPv6 address is a link-local address because of the fe80 prefix. Through multicast neighbor solicitation messages, IPv6 nodes can discover network settings from routers and also assign themselves a local IP address that always starts with fe80. This link-local address is used for local subnet (local link) network communications. This isn’t quite the same as an IPv4 Automatic Private IP Address (APIPA) configuration; IPv6 nodes always have a link-local address, even if they acquire another IPv6 address through DHCP or are configured with a static IPv6 address.

The following list describes common IPv6 network prefixes:

•   FE80  Self-assigned link-local address

•   FF  Multicast traffic

•   2001  Global unicast address

•   FC00  Unique unicast, similar to private IP ranges

IPv6 Settings

DHCPv6 can be used to provide IPv6 addresses and additional configuration settings such as DNS server addresses to IPv6 clients. (See RFC 5007 at https://tools.ietf.org/html/rfc5007 for more information.) You can also manually enter the IPv6 addresses for these components into the appropriate places. Instead of a subnet mask, IPv6 terminology favors “network prefix,” and it is expressed in CIDR format, such as /64, shown in Figure 5-10.

Figure 5-10  Manually configuring IPv6 settings in Windows

Modern operating systems and devices support IPv6. For example, Microsoft Windows Server 2019 has IPv6 enabled by default. Some operating systems may not have IPv6 enabled by default but can have it up and running in seconds if you configure it. You might consider disabling IPv6 in your network interface settings if you are sure it’s not needed in your environment. Reducing the server attack surface includes disabling unused components.

Believe it or not, June 6, 2012, was World IPv6 Launch day. The purpose was for many ISPs and major web sites to enable IPv6 support and leave it running, which they did. Break out the bubbly!

IPv6 Transition Technologies

The Internet today still uses primarily IPv4. As IPv6 becomes more and more common, and its use is growing, we’ll need a way to get IPv6 traffic sent through the IPv4 Internet. Table 5-4 describes IPv6 transition technologies.

Table 5-4  IPv6 Transition Technologies

Network Infrastructure Services

Network infrastructure is similar to a physical city infrastructure, which includes roads, bridges, and highways that enable the movement of people and goods. In a network environment, some fundamental services are required for large-scale IP addressing, name-to-IP address resolution, and internetwork connectivity.

Default Gateway

The term “default gateway” is an unfortunate choice of words; “gateways” have many meanings, but the term has become standard over the years (“default router” would have made much more sense). The default gateway is a router on your LAN through which you send traffic leaving the LAN. Without it, you are limited to communication with hosts on your local network. Each device that must communicate with devices on other networks must be configured with at least one default gateway IP address.

EXAM TIP   One thing to be careful of when given network diagram scenario exam questions is ensuring that you configure the IP address for the router interface connected to your network. Routers have at least two interfaces to interconnect networks. A second thing to watch out for is using the correct subnet mask. You must be able to talk to your router (default gateway) on your LAN.

DNS Servers

It’s probably fair to say that nobody remembers the IP addresses for all of the Internet services (including web sites) that they use. Instead, we humans have an easier time remembering names. It’s no problem remembering www.mheducation.com, but try memorizing 52.72.96.223, and doing similarly for hundreds of different sites where the IP address can change periodically.

Domain Name Service (DNS) is a lookup service that can run on a server or some kind of network appliance such as a router. As users, we normally have a name, but we need the corresponding IP address (your computer needs an IP address, not a name), and this is called a forward lookup. Occasionally, you may already know the IP address, but you’re looking for the corresponding name; this is called a reverse lookup.

Devices on a TCP/IP network must be configured with at least one DNS server IP address (and I would strongly recommend at least two). If the DNS server is down or the client can’t connect to it for some reason, it’s fair to say that everything grinds to a halt.

Using the Windows ipconfig /all command will reveal which DNS servers your network interfaces are configured to use, as shown in the next illustration. On a Linux host, you can open /etc/resolv.conf and add DNS server IP addresses to the file. You can use the nslookup command in both Windows and Linux to test connectivity to DNS servers.

DNS Hierarchy

DNS is a hierarchical naming structure. Top-level domains include suffixes such as .com, .edu, .net, and others. Second-level domains are those such as mheducation, google, and so on. When you add the host name (normally www for Internet web sites), you get a fully qualified domain name (FQDN) such as www.mheducation.com.

The domain suffix can be configured when you configure TCP/IP settings on a device. So if you are configuring IP on a server named server1, you might configure a domain suffix of widgets.com, which results in a FQDN of server1.widgets.com.

Prior to DNS servers becoming common, each TCP/IP device used a local text file called hosts to resolve names to IP addresses. You can imagine how difficult that would be to manage on a large scale.

WINS Servers

The Windows Internet Name Service (WINS) isn’t used often anymore. It is an old Microsoft standard for resolving NetBIOS computer names (such as computer1) to an IP address. It’s a flat structure; there’s no hierarchy as there is in DNS. Prior to WINS servers becoming common, each Microsoft system used a local text file called lmhosts to resolve NetBIOS computer names to IP addresses.

DHCP

Now that you know about configuring TCP/IP settings manually, let’s dive into how this gets done on a larger scale. DHCP, much like DNS, is a standard network service that runs on a server or some network device such as a router (including Wi-Fi routers). To cut to the chase, DHCP is nothing more than TCP/IP settings configured centrally and delivered to clients over the network. But wait! How can that work if a client doesn’t have an IP address in the first place? Read on.

Devices that attempt to acquire TCP/IP settings using DHCP execute a four-packet exchange as follows:

1.   DHCP Discover

•   The client sends a network broadcast seeking a DHCP server.

•   If this fails, the client assigns itself an automatic private IP address (APIPA) that has a prefix of 169.254. This enables communication only on the LAN with other devices in the 169.254 range.

2.   DHCP Offer

•   Each DHCP server (if more than one) responds via broadcast, if the client does not already have an IP address from a previous DHCP session, with an IP address lease offer. If a client is simply renewing an existing IP address lease, a unicast transmission is sent to the client.

•   The DHCP client works with the first offer it receives.

3.   DHCP Request

•   The client broadcasts its acceptance of the offer, which is received by the DHCP server.

4.   DHCP Acknowledgment

•   The DHCP server sends an ACK packet to the client along with any additional configured TCP/IP settings. This transmission could be sent via a broadcast if the client doesn’t already have an IP address, or it could be sent via unicast if the client is renewing an existing DHCP lease.

DHCP clients will attempt to renew their leases before they expire. The time interval differs between different versions of operating systems, but generally it’s at 50 percent of the lease. You can use the ipconfig /all Windows command to view DHCP server and lease information, as shown in the next illustration. If you’re a Linux person, you can use the cat command to view the contents of the DHCP lease file, which normally resides at /var/lib/dhcp.

TCP and UDP

TCP is one type of transport available in the TCP/IP suite; User Datagram Protocol (UDP) is the other. Software developers determine whether TCP or UDP will be used. In some rare cases, this may even be a configuration option within a network service or application.

TCP

You’ll come across plenty of literature that states that TCP is a “connection-oriented, reliable protocol.” Great. What exactly does that mean?

It means that a session is established between two communicating devices before transmitting data for the purposes of negotiating session parameters. This is done with the TCP three-way handshake. Let’s detail this packet exchange:

1.   SYN  Initial sequence number (ISN) is sent by the initiator and is used to track data sent and received.

2.   SYN ACK  Sent back from the target, this is an acknowledgment of receipt of the initiator’s ISN and also includes the target’s ISN.

3.   ACK  Sent by the initiator, this acknowledges receipt of the target’s ISN.

4.   Data can now be transmitted between the parties and is acknowledged by the opposite end of the connection; otherwise, the packet is retransmitted if the sender doesn’t get an ACK from the recipient after a time interval.

Port Numbers

Network services running on a TCP/IP device need some kind of unique identifier. Let’s say your server has a single IP address of 200.200.1.1 and you’re running a web site and an SMTP mail server. How can you uniquely identify the web server versus the mail server on the same IP address? Easy! Via the port address. It’s similar conceptually to a separate channel of communication. Web servers normally listen on TCP port 80 and SMTP mail servers normally listen on TCP port 25, although administrators can set the listening ports for most services.

Port addresses are also referred to as Layer 4 addresses, whether TCP or UDP. Despite this, protocols such as HTTP, DNS, and SMTP, to name just a few, are Layer 7 protocols. Remember that higher layers in the OSI model rely on some or all lower layers, depending on the specific protocol.

Port numbers are software addresses that uniquely identify network services, and the valid port range falls within 1 to 65,535, where the first 1024 are reserved for well-known services, such as those listed in Table 5-5.

Table 5-5  Common TCP-based Network Services

Use the netstat command in Windows operating systems to see which port you are connected to for a given network service, as well as the local client port used. Client ports and channels are used for network services to transmit data back to clients, and the values are always above 1024. For a more detailed packet analysis, you can capture network traffic using tools such as Wireshark, as shown in Figure 5-11.

Figure 5-11  A Wireshark packet capture showing the fields within a TCP header

UDP

UDP is much simpler than TCP. Because it is neither connection-oriented nor reliable, there is much less overhead at the cost of reliability. You can see this in Figure 5-12. UDP is often used for data transmissions where timing is crucial such as with VoIP, streaming applications, multi user gaming, and DNS queries, to name just a few uses.

Figure 5-12  A Wireshark DNS packet capture showing UDP header fields

UDP does not use a three-way handshake; there are no sequence numbers and there are no acknowledgments for each packet transmitted. It basically sends out packets and then immediately forgets about it. Like TCP, UDP-based network services are also uniquely identified with a port number. Table 5-6 shows some common UDP-based services.

Table 5-6  Common UDP-based Network Services

Hands-on Exercises

Exercise 5-1: Manually Configure IPv6 on Windows Server

1.  Make sure your Srv2019-1 virtual machine is running in VMware Workstation and that you are logged on using the Domain Administrator account (Fakedomain\Administrator) with a password of Pa$$w0rd172hfX.

2.   From the Windows Start menu, open the Control Panel, click Network and Internet, and then click Network And Sharing Center.

3.   On the left, click Change Adapter Settings.

4.   Right-click the Internal network adapter and choose Properties.

5.   In the Properties window, select Internet Protocol Version 6 (TCP/IPv6), and then click Properties to open the TCP/IPv6 Properties window, shown next.

6.   Choose Use The Following IPv6 Address.

7.   In the IPv6 Address field, enter 1:2:3:4::abcd.

8.   In the Subnet Prefix Length field, enter 64.

9.   Ensure that the Preferred DNS Server is set to ::1. Click OK and then Close.

10.   From the Windows Start menu, enter cmd and press ENTER.

11.   Type ipconfig and press ENTER. Notice that the Internal network adapter has both an IPv6 address and a link-local IPv6 address.

12.   Type ping 1:2:3:4::abcd and press ENTER. You should see four replies. Leave the virtual machine running.

Exercise 5-2: Manually Configure IPv4 and IPv6 on Ubuntu Linux

1.   Make sure your Ubuntu-1 virtual machine is running in VMware Workstation and that you are logged in as user uone with a password of Pa$$w0rd172hfX. Ensure that the Srv2019-1 virtual machine is also running.

2.   On your Ubuntu-1 computer, enter ip a to list network interfaces. One of the interface listings will already have an IPv4 address in the 192.168 range through DHCP. Take note of this interface name, such as ens33.

3.   Type sudo nano /etc/netplan/, and then press TAB to complete the network configuration filename in the /etc/netplan/ directory. The filename will look something like this: 00-installer-config.yaml.

Make sure the file contents look like the following, replacing ens33 with whatever your network interface name is from step 3:

4.   Press CTRL-X, press Y, and press ENTER to save the configuration file

5.   Type sudo netplan try and press ENTER to test the syntax. No errors will be reported if the syntax in the file is correct, in which case press ENTER to apply the new network configuration.

6.   Type ip a and press ENTER. For your network interface, you will see that the 192.168.1.201 and 1:2:3:4::bcde IP addresses are listed.

7.   Switch to the Srv2019-1 virtual machine and open a command prompt. Type ping 192.168.1.201 and press ENTER. This is the IPv4 address of the Linux server. You should see four replies.

8.   On the Srv2019-1 virtual machine, type ping -6 1:2:3:4::bcde. This is the IPv6 address of the Linux server. You should see four replies.

Exercise 5-3: Install and Configure NAT on Windows Server

1.   Make sure your Srv2019-1 virtual machine is running in VMware Workstation and that you are logged on using the Administrator account with a password of Pa$$w0rd172hfX.

2.   Start Windows PowerShell from the Start menu.

3.   Enter the following:

install-windowsfeature routing -includemanagementtools

4.   After the Routing and Remote Access server role is installed, leave PowerShell running, and from the Windows Start menu, type Rout. When the Routing And Remote Access option appears, click it.

5.   Right-click Srv2019-1 in the left panel and choose Configure And Enable Routing And Remote Access. Click Next.

6.   Choose Network Address Translation (NAT) and click Next.

7.   Click ExternalNAT for the public interface. Click Next, and then Finish. If you receive a message related to firewall ports, click OK.

8.   To allow ICMP ping packets to Srv2019-1, from PowerShell, enter the following:

9.   On the Ubuntu-1 virtual machine, in a terminal window, type ping www.mheducation.com. The name will be resolved to an IP address and you will see replies, because NAT (technically PAT!) on Srv2019-1 is allowing access to the Internet; all outbound traffic from internal hosts will assume the address of 200.1.1.1.

NOTE   Network devices can use NAT only if the internal IP address of the NAT router is set as their default gateway.

Exercise 5-4: Use Wireshark to Capture and Analyze HTTP Traffic

This exercise can be completed from any Windows computer that has access to the Internet, where the computer allows downloading and installing software from the Internet.

1.   Using the web browser on your computer (and not in the lab virtual machines), go to www.wireshark.org. Download and install the appropriate Windows Installer and then accept all installation defaults. Leave the web browser open.

2.   From the Start menu, launch Wireshark.

3.   Double-click a network interface your computer uses for Internet connectivity (the name could be just about anything), where there is a squiggly line (this means network activity). Don’t click network interfaces for VMware; you want to capture network traffic on your real computer. Wireshark will then capture network packets on the selected network interface.

4.   Switch over to your web browser and connect to www.mheducation.com.

5.   Switch back to Wireshark, and choose Capture | Stop. Notice all of the captured network packets.

6.   In the address bar (it should currently say Apply A Display Filter), type http and press ENTER. Now only HTTP network traffic is shown.

7.   Choose Edit | Find Packet. On the newly displayed search line, select the Display Filter drop-down and click String. To the far left on the same line, click Packet List and choose Packet Details. In the field to the right, type mheducation. Click the Find button on the far right. The first HTTP packet containing mheducation is selected.

8.   In the middle of the screen, you will see packet headers. Select the Transmission Control Protocol header. Notice the source and destination port values. If the packet is an HTTP transmission to the web site, the destination port will be 80 (443 for HTTPS) and the source port will be a higher value; otherwise, the port numbers will be reversed. These are Layer 4 addresses.

9.   In the packet header section, select the Internet Protocol Version 4 header. You may need to scroll down a bit in the middle panel to see the source and destination IP addresses. These are Layer 3 addresses.

10.   In the packet header section, select the Ethernet II header. Notice the source and destination MAC addresses. These are Layer 2 addresses.

11.   Close Wireshark without saving the capture.

NOTE   Do you see how the OSI model layers are reflected in sequence (Layers 2, 3, 4, and so on) when viewing packet headers? This is not a coincidence.

Chapter Review

If it seems to you that server experts must also be network experts, you are correct! Your servers can interact with a large variety of services and network components on a large scale, and you must understand how all the moving parts work together.

The OSI Model

The seven-layer OSI model is used to explain communication hardware and software, and the layers, beginning with Layer 7, are application, presentation, session, transport, network, data link, and physical.

•   Higher level software applies to Layer 7, the application layer.

•   How data is presented applies to Layer 6, the presentation layer.

•   The establishment, maintenance, and termination of sessions apply to Layer 5, the session layer.

•   Port numbers apply to Layer 4, the transport layer.

•   IP addresses apply to Layer 3, the network layer.

•   MAC addresses apply to Layer 2, the data link layer.

•   Cables, connectors, and electrical specifications apply to Layer 1, the physical layer.

Cables and Connectors

Groups of cables should be bundled together and routed in cable channels in racks throughout server rooms and data centers. Cable management arms prevent cables from being pulled tight when rack-mounted equipment is pulled out on rails from the rack. Labeled or color-coded cables keep things organized and facilitate troubleshooting.

RJ-11 connectors are used for telephone cables, and RJ-45 connectors are used for twisted pair copper network cables, which transmit electronic signals. CAT5 cabling supports transmissions at 10 or 100 Mbps. CAT5e has more cable pair twists per inch and supports up to 1000 Mbps. CAT6 supports 1 Gbps over 100 meters or 10 Gbps over 55 meters.

Fiber-optic cables transmit light waves, and data can travel greater distances without amplification. Single-mode fiber is used for longer distances than multi-mode fiber. Common connectors include ST, SC, LC, and SFP.

Network Interface Cards

NICs can be integrated on server motherboards or are available as expansion cards. NICs have a unique 48-bit hardware address called a MAC address, and they support enhanced features such as Wake-on-LAN, PXE boot, and NIC teaming. NIC teaming groups multiple network cards together for the purpose of redundancy or greater bandwidth.

IPv4 and IPv6

IPv4 uses a 32-bit IP address space, where each 8 bits is expressed in decimal format and separated by a period. TCP/IP configuration settings can be configured manually on each device or configured centrally using DHCP. The subnet mask determines which portion of the IP address designates the network and which portion designates the host on that network.

Subnetting occurs when host bits are borrowed to address subnetworks beyond the original network. This is done when additional network addresses cannot be acquired. In subnetting, all affected devices use the same new subnet mask.

Port Address Translation (PAT) enables multiple internal IP nodes to access a public network, such as the Internet, using a single public IP address. Network address translation (NAT) exposes internal hosts by mapping public IP addresses on the NAT router to internal private IP addresses.

IPv6 improves upon IPv4 with a larger 128-bit address space, security using IPSec, and more efficient network traffic management. IPv6 addresses are exposed in hexadecimal, where every 16 bits is separated by a full colon.

The default gateway is used when a device is transmitting data to a remote network outside of the LAN, and it must be on the same subnet as the device; the gateway is the IP address of a router. DNS servers provide a lookup service, most often for name-to-IP address resolution. Devices should point to at least one DNS server IP address for name resolution.

IP, TCP, and UDP

In the TCP/IP suite, IP is responsible for routing. TCP provides connection-oriented reliable transmissions, whereas UDP does not and is therefore quicker. Network services listen on a port address for client connections; the port must be unique on a given IP address. The first 1024 ports are reserved for well-known services such as an HTTP web server listening on TCP port 80.

Questions

1.   Which of the following is a valid concern regarding ceiling cable channels?

A.   Distance

B.   EMI

C.   Fire suppression

D.   Security

2.   What is the primary difference between the categories of copper-based network cables?

A.   Twists per inch

B.   Shielding

C.   Type of NIC

D.   Distance

3.   Which type of connector is commonly used with CAT6 cables?

A.   RJ-11

B.   SFP

C.   TX

D.   RJ-45

4.   Tamil is a network technician linking two older Ethernet switches together with a straight-through network cable. She later realizes the interswitch connection is not working. What should Tamil do?

A.   Replace the straight-through cable with a rollover cable.

B.   Replace the straight-through cable with a crossover cable.

C.   Replace the straight-through cable with a null modem cable.

D.   Replace the straight-through cable with a switch cable.

5.   You are planning the cabling for your company’s data center. A network speed of 10 Gbps is preferred. The maximum distance between servers and network switches is approximately 30 meters. Keeping costs to a minimum, what type of network cabling should be used?

A.   CAT5

B.   CAT6

C.   CAT6A

D.   CAT7

6.   Which type of fiber-optic cable should be used for the network backbone on a university campus?

A.   Single-mode

B.   Unimode

C.   Dual-mode

D.   Multi-mode

7.   Which spring-loaded fiber-optic cable connector is commonly used with multi-mode fiber cables?

A.   SC

B.   LC

C.   ST

D.   LT

8.   Which of the following statements best describe MAC addresses? Choose two.

A.   They are used to route network packets.

B.   Packets being sent to a host on a remote network are addressed to the host’s MAC address.

C.   MAC addresses are 48 bits long.

D.   Each server NIC has a unique MAC address.

9.   A data center uses disk images to deploy new physical servers quickly. Rather than have technicians apply the operating system images locally from disk media, network imaging is desired. Which technology must be configured?

A.   Wake-on-LAN

B.   NIC teaming

C.   Full duplex

D.   PXE

10.   Server1 has an IP address of 200.1.1.40/27. From Server1, you are attempting to make an SSH connection to Server2, whose IP address is 200.1.1.70/27, but you cannot connect. What might the problem be?

A.   /27 is invalid.

B.   200.1.1.0 is a reserved IP range.

C.   A default gateway is not properly configured on both servers.

D.   UDP port 22 is blocked on Server2.

11.   Which of the following is a valid IPv6 link-local address?

A.   fe80::883b:ced4:63f3:f297

B.   fd75::883b:ced4:63f3

C.   fe80::883b:ced4:63f3:fh97

D.   fd75::883b:ced4:63g3

12.   Widgets, Inc., has offices in London and Paris. The IT team has been directed to deploy IPv6 for test VLANs in both cities in anticipation of the eventual requirement of using IPv6. What should be configured to ensure that servers in each city test VLAN can communicate over the Internet?

A.   6to4

B.   ISATAP

C.   Teredo

D.   NAT

13.   A help desk technician is addressing network connectivity issues being experienced by a user, Charlie. Charlie’s station is unable to connect to a customer financial history database server on the same subnet named sect1-423.widgets.local, even though other stations do not have this problem; the error messages states “Unknown Host.” The technician successfully pings the default gateway to verify a valid IP configuration from Charlie’s station. What should the technician do next?

A.   Nothing. The server is down.

B.   Verify that Charlie’s station has a default gateway configured.

C.   Verify that Charlie has authenticated to the server first.

D.   Verify that Charlie’s station is properly configured with at least one DNS server.

14.   Your smartphone receives an alert stating that ServerHFX-234 is not responding. You connect to the server using hardware remote control and issue the ipconfig command. You then notice the server IP address is 169.254.46.63. Why is the server having communication problems?

A.   The machine was unable to reach a DHCP server.

B.   The machine must be configured with a private IPv4 address.

C.   The machine is not configured with a DNS server IP address.

D.   The machine is not configured with a valid subnet mask.

15.   A colleague, Malia, discusses the newly installed Layer 3 switches in the wiring closet. What benefit does a Layer 3 switch offer beyond a Layer 2 switch?

A.   Bridging

B.   Switching

C.   Routing

D.   VLANs

16.   Which of the following are valid methods of configuring VLAN membership? Choose two.

A.   Username

B.   IP address

C.   Switch port

D.   PKI certificate

17.   What type of address applies to Layer 2 switches?

A.   IP

B.   Port

C.   LUN

D.   MAC

18.   What type of address applies to Layer 3 switches?

A.   IP

B.   Port

C.   LUN

D.   MAC

19.   Which software communication method is not used with IPv6?

A.   Broadcast

B.   Unicast

C.   Multicast

D.   Anycast

20.   A new HTTP intranet web server is installed. Your boss asks you to configure the firewall appliance to enable people to browse to the new site. Which port should be allowed through the firewall appliance?

A.   25

B.   110

C.   80

D.   443

Questions and Answers

1.   Which of the following is a valid concern regarding ceiling cable channels?

A.   Distance

B.   EMI

C.   Fire suppression

D.   Security

C. Ceiling cable channels must be oriented carefully to avoid reducing the effectiveness of fire suppression systems. A, B, and D are incorrect. Although distance is a concern, because cables have a maximum effective distance, this is much less relevant than fire suppression. EMI can be a concern if ceilings have fluorescent lighting and cables are unshielded, neither of which is mentioned. Ceiling cable channels have no bearing on security.

2.   What is the primary difference between the categories of copper-based network cables?

A.   Twists per inch

B.   Shielding

C.   Type of NIC

D.   Distance

A. More twists per inch for copper wire pairs means less interference from adjacent wires. This allows for transmissions at higher frequencies, which results in greater bandwidth. B, C, and D are incorrect. Although some categories of cables differ in their shielding, this is not as prevalent a difference as twists per inch. The type of NIC and the distance are not distinguishing differences between different copper cable categories.

3.   Which type of connector is commonly used with CAT6 cables?

A.   RJ-11

B.   SFP

C.   TX

D.   RJ-45

D. RJ-45 connectors are common with CAT6 cables. A, B, and C are incorrect. RJ-11 connectors are used with telephone cables. SFP is a hot-pluggable network transceiver used most often to interconnect fiber cables. TX is not a valid network cable connector type.

4.   Tamil is a network technician linking two older Ethernet switches together with a straight-through network cable. She later realizes the interswitch connection is not working. What should Tamil do?

A.   Replace the straight-through cable with a rollover cable.

B.   Replace the straight-through cable with a crossover cable.

C.   Replace the straight-through cable with a null modem cable.

D.   Replace the straight-through cable with a switch cable.

B. Crossover cables reverse the transmit and receive wires at either end, which is sometimes required for older network switches. A, C, and D are incorrect. Rollover cables are used to connect administrative stations to the console port on network equipment such as routers. Null modem cables are used to link modem devices directly together. There is no such thing as a switch cable.

5.   You are planning the cabling for your company’s data center. A network speed of 10 Gbps is preferred. The maximum distance between servers and network switches is approximately 30 meters. Keeping costs to a minimum, what type of network cabling should be used?

A.   CAT5

B.   CAT6

C.   CAT6A

D.   CAT7

B. CAT6 cabling supports 10 Gbps over distances up to 55 meters. A, C, and D are incorrect. CAT5 supports up to 1 Gbps. CAT6A and CAT7 would work but are more costly than CAT6.

6.   Which type of fiber-optic cable should be used for the network backbone on a university campus?

A.   Single-mode

B.   Unimode

C.   Dual-mode

D.   Multi-mode

D. Multi-mode fiber should be used over shorter distances, such as on a university campus. A, B, and C are incorrect. Single-mode fiber is often used over longer distances and is more expensive than multi-mode. Unimode and dual-mode fiber are not common terms.

7.   Which spring-loaded fiber-optic cable connector is commonly used with multi-mode fiber cables?

A.   SC

B.   LC

C.   ST

D.   LT

C. ST connectors are commonly used with multi-mode fiber-optic cables. A, B, and D are incorrect. SC connectors are square shaped and not spring-loaded. LC connectors, like SC, are square snap-in connectors that are commonly used with single-mode fiber-optic cables. LT is not a valid type of connector.

8.   Which of the following statements best describe MAC addresses? Choose two.

A.   They are used to route network packets.

B.   Packets being sent to a host on a remote network are addressed to the host’s MAC address.

C.   MAC addresses are 48 bits long.

D.   Each server NIC has a unique MAC address.

C, D. MAC addresses are 48 bits long and expressed in hexadecimal format. Each server NIC will have its own unique MAC address. A and B are incorrect. IP addresses are used to route packets, not MAC addresses. Transmitting nodes do not know the MAC address of a target node on a remote network.

9.   A data center uses disk images to deploy new physical servers quickly. Rather than have technicians apply the operating system images locally from disk media, network imaging is desired. Which technology must be configured?

A.   Wake-on-LAN

B.   NIC teaming

C.   Full duplex

D.   PXE

D. PXE booting makes it possible to boot from a NIC to retrieve a small operating system from a boot server that runs locally in server RAM. This is commonly used for imaging. A, B, and C are incorrect. Wake-on-LAN is used to wake up powered-down systems and should be used for desktops and not servers. NIC teaming is used to group together server NICs to increase bandwidth or redundancy. Full-duplex communication enables traffic to be sent and received simultaneously over the network cable.

10.   Server1 has an IP address of 200.1.1.40/27. From Server1, you are attempting to make an SSH connection to Server2, whose IP address is 200.1.1.70/27, but you cannot connect. What might the problem be?

A.   /27 is invalid.

B.   200.1.1.0 is a reserved IP range.

C.   A default gateway is not properly configured on both servers.

D.   UDP port 22 is blocked on Server2.

C. A default gateway is not properly configured on both servers. A, B, and D are incorrect. The /27 is a valid subnet mask, 200.1.1.0 is not a reserved IP range, and SSH uses TCP (not UDP) port 22.

11.   Which of the following is a valid IPv6 link-local address?

A.   fe80::883b:ced4:63f3:f297

B.   fd75::883b:ced4:63f3

C.   fe80::883b:ced4:63f3:fh97

D.   fd75::883b:ced4:63g3

A. fe80::883b:ced4:63f3:f297 is a valid IPv6 link-local address. Link-local addresses are self-assigned by IPv6 nodes and enable LAN communications. This type of address is always present on IPv6 nodes. B, C, and D are incorrect. fd75::883b:ced4:63f3 is not a link-local address; the prefix must be fe80. In addition, fe80::883b:ced4:63f3:fh97 and fd75::883b:ced4:63g3 are invalid; hexadecimal uses only numbers 0–9 and letters A–F.

12.   Widgets, Inc., has offices in London and Paris. The IT team has been directed to deploy IPv6 for test VLANs in both cities in anticipation of the eventual requirement of using IPv6. What should be configured to ensure that servers in each city test VLAN can communicate over the Internet?

A.   6to4

B.   ISATAP

C.   Teredo

D.   NAT

A. 6to4 enables IPv6 networks to communicate over the IPv4 Internet; routers in both locations must support IPv6 on their internal interfaces. B, C, and D are incorrect. ISATAP is used on an IPv4 intranet, not the Internet. The Teredo standard enables IPv6 communication over the IPv4 Internet for IPv6 nodes behind NAT routers.

13.   A help desk technician is addressing network connectivity issues being experienced by a user, Charlie. Charlie’s station is unable to connect to a customer financial history database server on the same subnet named sect1-423.widgets.local, even though other stations do not have this problem; the error messages states “Unknown Host.” The technician successfully pings the default gateway to verify a valid IP configuration from Charlie’s station. What should the technician do next?

A.   Nothing. The server is down.

B.   Verify that Charlie’s station has a default gateway configured.

C.   Verify that Charlie has authenticated to the server first.

D.   Verify that Charlie’s station is properly configured with at least one DNS server.

D. DNS enables connections to hosts by name instead of IP addresses. A, B, and C are incorrect. We know the server is not down because other stations can connect. The default gateway is not used for communication on the local subnet. Authentication is not the problem, because we know the error is that the server name is not even a known host.

14.   Your smartphone receives an alert stating that ServerHFX-234 is not responding. You connect to the server using hardware remote control and issue the ipconfig command. You then notice the server IP address is 169.254.46.63. Why is the server having communication problems?

A.   The machine was unable to reach a DHCP server.

B.   The machine must be configured with a private IPv4 address.

C.   The machine is not configured with a DNS server IP address.

D.   The machine is not configured with a valid subnet mask.

A. Systems will assign themselves an APIPA address beginning with 169.254 when a DHCP server cannot be contacted. B, C, and D are incorrect. The symptom does not indicate in any way that the server needs a private IPv4 address, DNS server, or subnet mask configuration.

15.   A colleague, Malia, discusses the newly installed Layer 3 switches in the wiring closet. What benefit does a Layer 3 switch offer beyond a Layer 2 switch?

A.   Bridging

B.   Switching

C.   Routing

D.   VLANs

C. Layer 3 switches can use IP routing to transmit packets to destination networks instead of relying solely on MAC addresses and switch ports. A, B, and D are incorrect. Bridging is a Layer 2 mechanism for network segmentation that is based on MAC addresses. Although switching can apply to Layers 2 and 3, it is not solely related to Layer 3. Virtual local area networks (VLANs) are also available with Layer 2 switches, such as port-based VLANs, which group devices together based on the switch ports they are plugged into.

16.   Which of the following are valid methods of configuring VLAN membership? Choose two.

A.   Username

B.   IP address

C.   Switch port

D.   PKI certificate

B, C. Switch administrators can configure VLAN membership by IP address and by switch port. A and D are incorrect. Usernames and PKI certificates are not used to configure VLAN membership.

17.   What type of address applies to Layer 2 switches?

A.   IP

B.   Port

C.   LUN

D.   MAC

D. MAC addresses are Layer 2 addresses. The MAC address is the hardware address of a network interface. A, B, and C are incorrect. IP addresses are Layer 3 addresses, ports are Layer 4 addresses, and a LUN is a unique value assigned to network storage.

18.   What type of address applies to Layer 3 switches?

A.   IP

B.   Port

C.   LUN

D.   MAC

A. IP addresses are Layer 3 addresses. B, C, and D are incorrect. Port addresses apply to Layer 4, LUNs are unique values assigned to network storage, and MAC addresses are Layer 2 hardware addresses.

19.   Which software communication method is not used with IPv6?

A.   Broadcast

B.   Unicast

C.   Multicast

D.   Anycast

A. IPv6 does not use software broadcasts. B, C, and D are incorrect. IPv6 unicasts are one-to-one transmissions, multicasts are one-to-many, and anycast traffic is sent to the nearest device interface configured with the anycast address.

20.   A new HTTP intranet web server is installed. Your boss asks you to configure the firewall appliance to enable people to browse to the new site. Which port should be allowed through the firewall appliance?

A.   25

B.   110

C.   80

D.   443

C. HTTP web servers normally listen for client connections on TCP port 80. A, B, and D are incorrect. SMTP uses port 25, POP3 uses 110, and HTTPS uses 443.

CHAPTER 6

Server and Network Security

In this chapter, you will

•   Examine different types of security controls

•   Determine how to secure resource access

•   Identify best practices for hardening networks and servers

•   Learn how encryption protects server data

This chapter provides a great reference for technicians responsible for setting up security controls that protect not only servers but also the network environment in which those servers live. A few scary security examples are scattered throughout the chapter to put you in a security frame of mind.

Physical Security Measures

Technological security solutions are great; they solve business problems efficiently and are absolutely required for businesses to remain competitive and safe. But sometimes old-school methods can be overlooked. Security measures such as firewalls and antimalware won’t help if your server disks are not behind locked doors in a protected facility. They also won’t help if users are not made aware of potential security problems and how to mitigate them.

Premises Access

The first line of physical defense is perimeter security, which comes from the following:

•   Fencing

•   Bollard posts to protect buildings from vehicle incursion

•   Lighting

•   Locked gates

•   Security guards

•   Guard dogs

•   Limited access to areas of a facility

•   Motion-sensing security systems

It doesn’t make sense for every organization and government agency to implement all of these measures, but some of them can be implemented to improve security.

Access to a physical structure is always an issue. And it is a very big deal when it comes to data centers, because hundreds or thousands of customers’ personal data may be stored in a data center and is ideally replicated to other data centers for fault tolerance. This is why some providers are reluctant to reveal the addresses of their data centers.

Consider data center “camouflage,” such as an unmarked building located in a densely forested area or a nondescript concrete building with little signage. Locked doors with reinforced doorframes can protect the facility from unauthorized entry. Reflective glass can be used for external windows and internal office spaces to enable viewers to look out through the glass, but not the other way around. For security and privacy reasons, data centers normally have few external windows.

Security guards are important aspects of building security, even if their services are shared by multiple tenants. A visiting guest who is expected to enter a secured facility should be placed on an access list ahead of time so guards can refer to the list when the guest arrives and provides identification. Many business locations require that guests and personnel present some kind of ID card—in some cases a photo ID—before they can enter the facility, especially after hours.

Access control vestibules (sometimes referred to as mantraps) are used at building entrances where high security is a must. In these vestibules, a second inner door opens only after the first outer door has been closed and locked. This prevents tailgating, when an unauthorized person slips through a door behind an authorized person.

Of course, a security camera, another important security defense, would capture somebody slipping in behind you. Every facility has a policy regarding surveillance footage retention, if it is retained at all. The mere presence of a security camera can serve as a deterrent to bad behavior, as can signage stating that the area is being watched. The wording on signage can be important for legal reasons: you don’t want parties claiming they didn’t know they were being watched and that their privacy rights have been violated.

Once people have physical access to the facility, internal physical controls can further keep sensitive information safe. In a clean desk policy, personnel are prohibited from leaving sensitive documents in areas where anybody can see them; locking up sensitive documents or even backup tapes in a locked cabinet is better than leaving them out in the open.

Card-based Access

Radiofrequency identification (RFID) chips are embedded in many types of cards, including building access cards and toll cards for roads and bridges. RFID was designed to be used for inventory and asset tracking, but its use has expanded in a variety of ways.

You may be wondering how an RFID card differs from a smartcard. Smartcards, such as debit and credit cards, are designed to be used for payment systems, and they have more built-in security than RFID cards. RFID chips have a longer wireless range than smartcards, which introduces more security vulnerabilities. Payment cards normally encrypt wireless transmissions to the receiving terminal, and these days that’s done often using close-range wireless solutions such as near-field communication (NFC). RFID cards, on the other hand, are not encrypted. With either card type, the primary benefit is convenience. You may have to enter a PIN to use a card, but it’s still very easy to use. The downside is that somebody else may be able to scan your private data stored on a card.

The type of data stored on a card varies from one vendor’s card to another, but generally you can expect the following:

•   Card type

•   Account numbers

•   Account expiry

•   Account holder name

•   Card and account expiration dates

•   PIN, or a hash of a PIN

Forging a smartcard is extremely difficult to do, because we’re talking about a microprocessor chip embedded into a card (Figure 6-1). An average thief will not be able to reproduce this.

Figure 6-1  Embedded chip on a payment card

The Human Element

People are the biggest security threat of all. Companies should implement strict hiring and background check policies to ensure that employees can be trusted with sensitive information. Segregation of duties must be enforced to ensure no single person controls a process from beginning to end. This is not limited to processes involving money but can extend to preventing individual persons from having knowledge of an entire cryptographic key; the key is available only when each of several persons provides his or her part of the key, which requires knowledge of a password or possession of a physical or digital unique token.

NOTE   Still, no system is perfect. Consider, for example, intelligence agent Jeffrey Delisle of the Royal Canadian Navy, who supplied sensitive information to a Russian spy agency beginning in 2007. I went to high school with Jeff in the late ’80s; needless to say, I was absolutely floored when I became aware of this situation.

The other aspect of the human security element is user awareness and training. The best technical safeguards are not effective if users don’t understand threats such as social engineering and e-mail phishing; it pays to be somewhat paranoid and cynical when it comes to IT security! Providing documentation to employees about security awareness is usually not as effective as lunch-and-learn sessions presented by dynamic speakers who make these important issues much more memorable.

Authentication

Authentication is the process of proving one’s identity. Technicians generally assume that authentication applies only to individual users, but it can also be used to prove the identity of

•   Devices

•   Services

•   Applications

Everybody is familiar with supplying a username and password to authenticate to a system, but security can be increased by using additional authentication factors. At the device level, a smartphone with a virtual private network (VPN) app may need a unique device Public Key Infrastructure (PKI) security certificate that is trusted by the VPN server before the user even gets a chance to provide his credentials to the VPN. Or a client desktop may require a unique PKI certificate before granting access to a restricted web site. Normally, secured web sites require a PKI certificate only on the server side, but for very sensitive sites, connecting clients may need a certificate installed on their device too.

A security certificate can be applied to the software, so that when it executes it can authenticate to another component for proper functionality. For example, a web service may use a PKI certificate to authenticate to a back-end database.

Successful authentication is required before access is granted to computing resources such as web sites, databases, files, and so on. There are various categories of authentication, as discussed in the following sections.

Identity Federation

Today’s business computer environments are increasingly complex: there are business-to-business connectivity requirements as well as on-premises–to–public cloud connections. There needs to be a way to centralize authentication that supports Single Sign-On (SSO).

Identify federation strives to provide a single centralized identity store. “Single” doesn’t mean it can’t be replicated to multiple servers. Think of a company that plans to use public cloud services and has Microsoft Active Directory (AD) user accounts configured on-premises already. Why re-create users and passwords in the cloud for authentication to cloud apps, when those users already have accounts in AD? Even existing password policies enforcing password length and lockout settings would still be effective.

Web applications can be configured to trust security tokens issued from a trusted identity store. Security tokens contain claims, or assertions about a user or device. For example, a user claim might consist of an e-mail address and a date of birth. Different applications will consume different claims and can provide different scopes of access depending on claim values; it depends on the app.

With identify federation, apps don’t have to handle authentication themselves; instead, they consume trusted security tokens containing claims. Replicating existing user account credentials from on-premises to the cloud enables web SSO, so that after their initial authentication, users don’t have to keep entering their credentials when they access different resources.

EXAM TIP   Expect exam questions related to configuring authentication between on-premises and cloud environments. Web SSO between on-premises networks and public cloud providers is achieved by replicating an on-premises directory service to a cloud-based directory service.

Microsoft Active Directory Federation Services (ADFS) handles identity federation nicely, as do other solutions such as the open-source Shibboleth product. Figure 6-2 shows how claims can be configured: the Employee-ID attribute in the left column is changed in the claim to EmpID. This would occur if a consuming web app needed to see a claim with EmpID and not Employee-ID; this will vary from application to application.

Figure 6-2  Mapping an LDAP attribute to an outgoing claim

Something You Know

This type of security is stored in your head—and hopefully in nobody else’s. A password, PIN, mother’s maiden name, color of your first car, middle child’s nickname are something you know—stuff about you that shouldn’t be easy to figure out or find on social media or through web searches.

Most authentication today still relies on a username and password combination. Even though this consists of two items, they both fall under a single category (something you know), so we call this single-factor authentication.

EXAM TIP   Watch out for questions that reference multifactor authentication, and make sure the methods mentioned are from different authentication categories.

The problem with the traditional password is that it’s not really all that secure—and users hate it. If you’re using passwords, you have to change them periodically based on your organization’s security policy. This is a tedious task; users are normally required to change their passwords to something they’ve never used before, and the new password must meet complexity requirements, such as some uppercase and lowercase letters, numbers, and symbols. No wonder users get exasperated!

Problems with passwords result in user frustration, less time spent at work being productive, increased help desk costs, and—as if that’s not enough—they are not very secure. Nevertheless, a username/password combination is still a popular authentication system in use today.

Something You Have

Some authentication mechanisms require that you have physical possession of something, such as a smartcard or a hardware token (also called security tokens or key fobs) that displays a changing numeric code that users must enter in addition to a username and password. These days, software apps can act as software tokens. Administrators make token files available to users to import into their software token application, as shown in Figure 6-3.

Figure 6-3  Configuring the RSA SecurID software token

When you use your debit chip card to pay for something, you’re using a smartcard. Of course, you must know the PIN to use it, but you must also have the card in your possession to use it—this is multifactor authentication (MFA). Small purchases, however, may not require the PIN with some cards.

A hardware token, such as an RSA token used for VPN authentication, is synchronized with the VPN device and has a small display showing a numeric value that changes periodically, such as every 90 seconds. This numeric value must be entered within an acceptable timeframe, in addition to some other type of authentication, such as username and password, before access to the VPN is granted. This numeric value is a form of a one-time password (OTP); it is never the same and is used for a single authentication session. Another OTP example is using a web site’s “Forgot password” feature, in which a unique code is sent via SMS text or e-mail that enables you to sign in only once, within a limited time frame, to reset a forgotten password.

Another example of something you have is a PKI security certificate. Your smartphone might use this to establish trust (at the device level) between the phone and a VPN appliance. The same holds true with servers that must trust each other before transmitting sensitive information.

Something You Are

Each and every one of us is biologically unique in some way. Nothing is perfect, though: a fingerprint scan could be defeated by forcing somebody to press his finger on a scanner, or, in a gruesome scenario, by an attacker taking a victim’s finger with him to place on a scanner. This category of authentication, biometric authentication, uses unique identifying characteristics related to your body, including the following:

•   Fingerprint

•   Voice recognition

•   Facial recognition

•   Speech or gesture recognition

•   Behavioral recognition

•   Retinal scan

•   Iris scan

•   Handwriting recognition

For years, certain laptop models have included built-in fingerprint scanners, or you can use an external fingerprint scanner connected via USB. Fingerprint scans generally require a unique eight-point match for successful authentication. This means the fingerprint scan must already exist somewhere on the system.

Many vendors offer products that enable biometric authentication integration with existing systems. For example, we could store fingerprints with Microsoft AD user accounts by extending the schema (blueprint) to enable this to be stored as an attribute of a user. Biometric authentication may also be configured to enable access to more sensitive data than would be available with only username and password authentication.

Under Lock and Key

You may have used a proximity or swipe card to gain access to a building and to certain floors or areas. Keypads are another option for opening doors, as well as arming and disarming security systems, but you have to know the code. Keypads are great for server rooms, because we don’t want unfettered access to racks of equipment that includes storage media. Server room doors should never be left open, even for ventilation reasons; HVAC environmental controls should be taking care of that!

A data center can contain thousands of physical servers (and tens or hundreds of thousands of virtual machines). Many rack systems for data centers have doors on the front and back that can be locked to control physical access to the equipment.

It may be important to use a lock-down security cable to protect expensive data projection units from theft, but these are replaceable and don’t contain sensitive company data as laptops would. Yet how often do we see laptops being locked down compared to projection units?

Mobile devices introduce enormous risks, yet they are ubiquitous in homes just as they are at work locations. As with USB thumb drives, mobile devices and storage media are easily lost, stolen, forgotten at a client site or in a taxi, and so on.

Logical Access Control

Logical access controls are the mechanisms put in place to secure authentication and authorization to use network resources such as shared folders, web apps, or databases. Mechanisms include the use of smart cards for authentication, or adding a user to a web app role to give them access to some or all of a web app.

Managing individual user access to resources is difficult on a large network; therefore, it is rarely done. Auditing individual users (as opposed to everybody at once) makes sense to reduce information overload, however.

Groups

The standard procedure for resource access in most of today’s networks is as follows:

1.   Create a group following company standards.

•   Naming conventions

2.   Grant resource permissions to the group.

•   Web site

•   Database

•   Files/folders

•   Categories of data

3.   Add members to the group.

•   Users

•   Devices

•   Other groups (group nesting)

NOTE   Adding group members in Microsoft AD requires that the user added to the group log off and log back on again. The access token that contains group memberships is updated only upon initial user logon.

Any user in a group who, for example, has been granted read and write permission to a file will inherit those permissions, because the user is a member of the group. One problem with groups is that you might need to create hundreds of groups to manage resource access, and that’s a lot of additional items to manage. Then there’s the issue of group membership being static (members are manually added and removed).

Some tools enable dynamic group membership, for example, based on some kind of characteristic, or rule, such as whether an employee is full-time or part-time, but you’re still managing a group. Be aware of distribution list groups, which is the case with Microsoft AD (see Figure 6-4), because this type of group (versus a security group) cannot be assigned permissions; it is designed for use by e-mail systems.

Figure 6-4  Creating a group using the Active Directory Administrative Center (ADAC)

Dynamic Access Control

Other solutions such as Microsoft Windows Server Dynamic Access Control (DAC) offer alternatives (see Figure 6-5). DAC is nothing new, other than the fact that it is now built into the operating system. DAC looks at user and device AD attributes to determine what level of access, if any, is granted to files and folders (resources). This can be done without groups, but somebody must have filled in the user and device attributes in AD. For example, DAC may enable only read access to a folder for full-time employees in Orlando, while full-time employees at headquarters may be given read and write permissions.

Figure 6-5  Configuring conditional file system permissions in Windows Server

Roles

Roles are similar to groups, but one difference is that a role may apply to a single individual, such as a CEO. As we do with groups, we assign resource permissions to roles and then assign a role occupant. The role occupant(s) then get the role permissions. This is referred to as role-based access control (RBAC). You can even delegate IT administrator tasks to other administrators using RBAC.

Rights and Permissions

In Microsoft environments, we have to be careful how we use the terms “rights” and “permissions.” A right is black-and-white: either you can or you cannot do something. For example, either you can change the date and time on a server, or you cannot. Permissions are a degree of access to a resource. For example, you might have only read permission to a file, or you might have read, write, and modify permissions to a file. Either way, rights and permissions can be assigned to users, groups, or roles, or they can be assigned conditionally based on attributes. Take care to follow the principle of least privilege, which is inconvenient, but it matters: assign only the rights and permissions necessary to perform a job task, and nothing more.

File System Permissions

Windows and UNIX/Linux servers support a wide variety of file system types depending on how the file system will be used. Some offer more advanced features such as encryption and local file system security.

Windows NTFS Permissions

Windows servers commonly use NTFS (New Technology File System), which offers benefits beyond the old File Allocation Table (FAT) file system, including the following:

•   Local file and folder permissions

•   File and folder encryption using Encrypting File System (EFS)

•   File system auditing

•   File system journaling (disk recovery and repair is quicker)

•   Data deduplication to save disk space

•   Disk space quotas

Standard NTFS permissions (Figure 6-6) include

Figure 6-6  NTFS standard permissions

•   Full Control

•   Modify

•   Read & Execute

•   List Folder Contents

•   Read

•   Write

•   Special Permissions

The List Folder Contents permission applies only when assigning permissions to folders, not files. A big distinction between Modify and Write permissions is that Modify enables file deletion and Write does not. Special Permissions provide a further degree of granularity; for instance, you may want to allow the creation of folders but not new files (by default, both are possible if a user is allowed to write).

NTFS permissions can be assigned to a drive, folder, or file. When assigned to a drive or folder, the permissions are inherited by subordinate file system objects. You can either allow or deny permissions. To alter permissions inheritance, you right-click a file or folder name and choose Properties. Then click the Security tab, the Advanced button, and then the Disable Inheritance button. You can also alter permissions inheritance by adding a new access control list (ACL) entry for a user, group, or computer with a different set of permissions that will then apply from that point in the file system down through the file system hierarchy.

NTFS uses a discretionary access control list (DACL), where the system administrator, at his or her discretion, sets file system permissions. Every drive, folder, and file has a DACL. Operating systems such as Security-Enhanced Linux (SELinux) use a mandatory access control (MAC) model where system policies determine which access users have to various aspects of the system, including files.

Windows Shared Folder Permissions

Individual files cannot be shared over the network, but folders can. To control network access to shared folders, we configure share permissions (Figure 6-7). As with applying permissions to any resource, groups are normally used.

Figure 6-7  Shared folder permissions

There are three shared folder permissions:

•   Full Control

•   Change

•   Read

NOTE   When you’re combining NTFS and share permissions, the most restrictive permissions will apply. A common strategy is to be a bit more liberal with share permissions and then lock things down granularly with NTFS permissions.

Linux File System Permissions

Many types of file systems are available for UNIX and Linux operating systems, including ReiserFS, ext4, and XFS, to name a few.

Some file systems support extended permissions, but here we will look at the standard permissions that will work on any type of UNIX/Linux file system:

•   Read (r), 4

•   Write (w), 2

•   Execute (x), 1

You’re probably wondering what the listed numbers mean. The r, w, and x should be self-explanatory. Read has an internal value of 4, write is 2, and execute is 1.

Three sets of these three permissions (r, w, and x) apply to the following:

•   Owner of the file or directory

•   Group associated with the file or directory

•   Everyone else

That’s why you’ll sometimes see commands such as chmod 760 project_b.txt (see Figure 6-8). The chmod means “change mode”; it’s how we set file system permissions at a shell prompt (there are Linux GUI shells that will enable this to be done without typing).

Figure 6-8  Setting file system permissions in Linux

Back to the example: chmod 760 /projects. The 7 in 760 applies to the file or directory owner, which in Figure 6-8 is shown as the first occurrence of “root” from the left. The 7 is the sum of 4 + 2 + 1 (r + w + x), so it means the owner (in this case root) has read, write, and execute permissions. The 6 value is the sum of 4 + 2 (r + w), so the group associated with the file or directory (in this case also root, the second occurrence from the left in Figure 6-8) has read and write permissions. The 0 means that neither read, nor write, nor execute has been assigned to everybody else.

The chmod command also has a-R command line switch (not shown in the figure) that recursively applies permissions to a directory and everything in and under it. Note that delete and modify are both included in the write permission. In most Linux distributions, if you are logged into Linux as the root superuser account, these file system permissions are not applied, because they are for nonroot users only.

NOTE   Don’t forget that Linux commands are case-sensitive! So Chmod and chmod are not the same thing!

Peripheral Devices

Access control should also be considered for peripheral devices such as data projectors, printers, and USB devices.

Projectors

Because a data projector doesn’t store sensitive company information and its contents won’t endanger human lives, there’s not much more you can do to lock it down beyond preventing it from being physically stolen or remotely projected to by placing it on an isolated and secured network. Modern projectors support wireless technologies such as Bluetooth and Wi-Fi, so they can be discovered on the network; make sure to secure the network the projector is on unless you are OK with anybody on the network potentially controlling the display. The same type of logic also applies to smart TVs.

Printers

Printers are another story. Some printers store queued jobs for a period of time, which could conceivably be retrieved by a determined malicious user. Whether or not the network printer is managed by a centralized print server, access to manage the printer must be secure. Change the default administrative username and password and make sure HTTPS administrative access is enabled (as opposed to HTTP).

One benefit of using a print server to manage printers is centralized management and security control. If you use a Windows print server or a Linux CUPS print server, you can determine what printing privileges are granted to different groups of users.

NOTE   Even though users can print directly to printers without a print server, remember that print servers provide centralized security and management.

USB

This is a catch-all category; pretty much any type of peripheral can be plugged into a computer via USB, and this is really important from a security standpoint. Malware infections are scary and can infect your server depending on what you plug into USB ports—not just into servers themselves, but also into any device that in some way can contact your servers.

Scary USB devices include

•   Certain types of USB cables that can infect devices they are plugged into (referred to as a USB Ninja Cable)

•   Smartphones

•   Tablets

•   Storage media

Ransomware sends a chill of fear down the backs of all server geeks. This type of malware is in epidemic mode as of the writing of this book. It executes on an infected computer and encrypts any files that the infected device can write to, including server and cloud storage. The only way to get a decryption key is to pay a ransom in bitcoins, assuming you’d get the key anyway. If you’re lucky, you’ll be able to rebuild affected systems quickly from images and backup, but it’s not always that easy, and this can be very costly, so weigh this risk against the cost of prevention and mitigation.

One way to mitigate USB threats is to disable USB ports for storage media, while allowing peripherals such as printers, keyboards, and mice. There are ways to enforce this centrally, such as using Group Policy in an AD environment, as shown in Figure 6-9. Of course, antimalware solutions can help with some infections, but not all of them. The best security measure? User awareness and education! Ransomware is usually spread by phishing e-mails or by people clicking malicious web page links or opening infected file attachments.

Figure 6-9  Configuring Group Policy to block access to removable storage

Network Security

Networks are cool: millions of interconnected devices share data around the planet in a matter of seconds. But this also means the bad guys (and gals) have an infrastructure in place to ply their despicable trade, such as compromising network hosts and transferring sensitive data (exfiltration) outside of the organization. On a corporate network, one important consideration is strictly controlling access to your networks in the first place.

NAC

Network Access Control (NAC) is often referred to as “port-based security.” These ports are logical, not physical—you can think of a port as some kind of entry point into a network.

When IT techies chat about NAC, you’ll also hear them mention “802.1X.” IEEE 802.1X is a worldwide standard for port-based security, or controlling access into your network. Think of the various network edge devices that enable connections to the network:

•   Network switches

•   Wireless routers

•   VPN appliances

These edge devices should never perform authentication for connecting devices and users. Why? Because they are the first point of contact by devices and users, and they could be compromised, and we don’t want a hacked VPN appliance to provide malicious users with usernames and passwords. Additionally, configuring user authentication information on each and every edge device just doesn’t scale well in a larger environment, even assuming each device can accommodate storing all of these credentials. Instead, these edge devices should forward authentication requests from devices and users to a central authentication authority—a RADIUS server.

RADIUS Servers

Remote Authentication Dial-In User Service (RADIUS) is an old standard that still persists today, with improvements made over the years. The idea is that edge devices (RADIUS clients) forward authentication requests from connecting devices and users (supplicants) before allowing network access. Only after successful centralized authentication via the RADIUS server will the device or users be allowed to access the network.

Your Windows or Linux server can easily be made into a RADIUS server by installing the appropriate software and configuring a RADIUS shared secret between the RADIUS clients and the RADIUS server (see Figure 6-10). Configure RADIUS clients to forward authentication requests to the RADIUS server. For Wi-Fi routers, use the WPA Enterprise or WPA2 Enterprise option.

Figure 6-10  Configuring a VPN appliance as a trusted RADIUS client

TACACS

Terminal Access Controller Access-Control System (TACACS) and its newer variant TACACS+ are designed to handle frequent authorization requests within a session; RADIUS is designed primarily for authentication at the beginning of a session. TACACS+ enhances security by encryption transmissions, and it is based on the TCP transport mechanism as opposed to UDP, which is used by RADIUS. TACACS+ is normally used to administer network devices, while RADIUS is used primarily for centralized authentication.

VLANs

A virtual local area network is similar conceptually to adding a new network segment to your existing network infrastructure. Technically, creating a new VLAN creates a new broadcast domain (just like a new physical network would). Network broadcasts are addressed to all devices on a network, although routers do not forward these broadcasts to other networks.

Let’s say, for example, that you have a 24-port OSI Layer 3 Ethernet switch. By default, all 24 ports are grouped into the same VLAN. This means that if you plug in 24 network devices and configure them on the same IP subnet, they can communicate with one another.

There are times, however, when you may want to split your 24-port switch into smaller networks. Why would you do this? Because smaller networks perform better than larger ones, and you might want isolation between networks—maybe a VLAN for deploying images to new computers (which slows down the network) and a separate VLAN for accounting computers.

From a security perspective, separate VLANs present a simple security barrier. A router is needed to enable communication between VLANs, and a Layer 3 switch can do this too; a Layer 2 switch does not have routing capabilities. VLANs are covered in more detail in Chapter 5.

TIP   Make sure you plug each physical server network interface card (NIC) into the correct switch port, especially if using port-based VLAN membership; otherwise, devices may not be able to communicate with the server.

VLAN Attacks

Even though traffic from one VLAN should not be able to reach a different VLAN without a router, as with everything in IT, there are vulnerabilities that actually let this happen, including, but not limited to, the following:

•   MAC flooding attacks  These fill MAC table limited memory on switches, which causes otherwise isolated traffic to be visible on other VLANs, which really has the switch acting as a hub; unicast traffic is visible to all devices in that VLAN.

•   VLAN hopping  Attacker spoofs the identity of another switch to create a trunking link through which all VLAN traffic can pass and is thus visible to the attacker.

It’s one thing to identify a weakness, but what can we do about it? Switch administrators can enforce proper switch VLAN configurations such as disabling automatic trunk negotiation, enabling strong port security, allowing connections from specific or a limited number of MAC addresses, and, of course, as a general hardening best practice, applying the latest firmware updates.

Firewalls

Firewalls control inbound and outbound traffic, whether for an entire network or for a single network device. Some firewalls look only at IP addresses, port numbers, and protocol types, while others (OSI Layer 7 firewalls) perform deep packet inspection. The best approach is to block everything and then create firewall rules to allow only traffic that is necessary.

Firewalls can be hardware or software based. Hardware-based appliances are generally more stable and can handle more traffic than their software counterparts. Just remember that hardware appliances also get firmware updates, so be sure to subscribe to vendor update notifications.

Host-based Firewalls

A host-based firewall runs as software on a specific host. Windows computers use the Windows Firewall (configured through the GUI or the command line), while UNIX and Linux systems can use command line tools such as iptables or Uncomplicated Firewall (uwf). These are both considered OSI Layer 4 firewalls because they can allow or deny traffic based on the following:

•   Source IP address

•   Destination IP address

•   Source port

•   Destination port

•   Protocol type

Some Windows services such as AD require multiple ports for communication, in which case it is possible to work with groups of firewall rules, some of which are already included in Windows.

Windows Firewall  The Windows Firewall can be configured in the GUI (Figure 6-11) or through the command line. Consider the following PowerShell example (not case-sensitive), which allows Active Directory–related communications by using a supplied firewall rule group:

Figure 6-11  Creating a firewall rule using the Windows Firewall GUI

Enable-NetFirewallRule -DisplayGroup "Active Directory Domain Services"

We could also add a custom firewall rule using PowerShell. In this example, assume we’ve installed an SSH listener on our Windows host. You don’t want to enable access through Telnet because usernames and passwords are sent in clear text. So, to allow inbound SSH traffic, you’d use this:

Linux Firewall  You can use a variety of methods to configure a Linux firewall. With some Linux variants, for example, to allow incoming SSH administrative traffic, an iptables command would look like this:

-A means to add to the INPUT chain, -p means protocol, -m means match, --dport is the destination port, and -j means jump to ACCEPT (the target of this rule).

You could then list firewall rules with the following command:

iptables -L

Network-based Firewalls

Routers or specialized appliances function as network-based firewalls. These devices have at least two network interfaces and can be configured with NACLs to control inbound and outbound traffic. They are placed on the network where network traffic that must be examined will flow into and out of the network, such as between the Internet and an internal network. These are often called perimeter firewalls.

Dedicated network-based firewall appliances are designed to be a firewall (unlike an operating system running firewall software) and are hardened to the hilt. They come in both hardware and software appliance forms.

Reverse Proxy Servers  A reverse proxy server is a type of network-based firewall. Forward, or “normal,” proxy servers fetch items from the Internet, such as web pages, on behalf of an internal client. Often, that content is cached on the proxy server to speed up subsequent requests for that same content.

Reverse proxy servers listen for incoming traffic, such as traffic destined for a web server. Although to the Internet it appears the reverse proxy server is the real web server, it isn’t; it simply forwards requests quietly to a web server on an internal protected network.

Deep Packet Inspection  In addition to basic firewall packet filtering (IP addresses, port numbers, protocol types), deep packet inspection (DPI) is a given with network-based firewalls. This advanced functionality tracks TCP sessions instead of treating each packet separately: this is called stateful packet inspection.

DPI goes beyond the OSI Layer 4 type of packet inspection; it goes all the way up to OSI Layer 7, the application layer. Allowing or blocking traffic based on details such as payload content provides much more functionality than allowing or blocking traffic based solely on packet headers.

Many public cloud companies offer various types of firewalls in the cloud, a part of Security as a Service (SECaaS). For example, the Microsoft Azure cloud uses Network Security Groups (NSGs) to control inbound and outbound traffic at the subnet and virtual NIC (VNIC) levels, as shown in Figure 6-12.

Figure 6-12  A Microsoft Azure Network Security Group rule

Distributed Denial-of-Service Attacks  Not all distributed denial-of-service (DDoS) attacks are sophisticated; conceptually speaking, DDoS attacks are like jamming a communication channel with static so nothing meaningful gets through. The “distributed” part of DDoS means an attacker could have hundreds or thousands of infected computers (zombies and zombie nets) at their disposal to execute the attack.

Packet flooding can bring down a victim server or an entire network if enough machines send enough bogus traffic in a short period of time. Servers and network infrastructure equipment can handle only so much traffic at a time; too much garbage traffic means legitimate traffic doesn’t get processed, and therein lies the issue. Of course, it takes very little to spoof the source IP address of the zombie computers that ran the attack, so tracking down the culprit machines is made more difficult.

One common mitigation technique is to “black hole” the traffic—to discard traffic destined for the victim. Of course, this means legitimate traffic is also lost, so the attacker is still achieving their malicious objective. Depending on the specific DDoS attack, router ACLs could block some traffic as well, but doing this could require hundreds of ACL rules. Suffice it to say the standard firewalls are not designed to mitigate DDoS attacks.

DDoS perpetrators often demand payment from victims before they will turn off the packet tap. You may remember the BetCRIS DDoS attacks in 2003. (BetCRIS is still an online sports betting site.) Attackers would launch a DDoS against BetCRIS before major live sporting events. The attackers demanded US$40,000 to cease the attacks for up to 12 months. For every day offline, BetCRIS lost up to $100,000. Although a software developer was able to block that particular attack, further attacks by DDoS extortionists are expected, and this type of attack is becoming more problematic for other online businesses.

Security Zones

Planning a network layout involves dealing with sensitive systems residing on protected internal networks and services that should be visible to the Internet on external public-facing networks. An intranet is an internal network that can offer connection services like those found on the Internet.

Isolation is key. Firewalls control traffic from the Internet into the public-facing network, which in turn has a second firewall that further controls traffic into and out of an internal secured network. You must always make sure that internal data is not replicated to a public-facing network—examples include DNS servers in a public network replicating with internal DNS servers—and the same goes for replicating directory services (such as Microsoft AD).

Screened Subnets

A screened subnet (formerly referred to as a demilitarized zone, or DMZ) is an external, public-facing network in which we place services that should be reachable from the Internet, such as the following:

•   VPN appliances

•   SMTP mail servers

•   Web servers

•   FTP servers

Normally, a reverse proxy exists in the screened subnet, which listens for client requests for these services, and the services themselves exist on a different internal network that is protected by a firewall. Figure 6-13 shows an example of a firewall layout in a screened subnet network.

Figure 6-13  Firewalls in a screened subnet layout

EXAM TIP   You could see an exam question about placement of firewalls or rules on a network architecture diagram. Remember that public services should exist in the screened subnet either literally, or they should be accessible from the screened subnet through a reverse proxy.

PKI

A Public Key Infrastructure (PKI) is a hierarchy of digital security certificates issued to users, devices, or services for the purposes of security. PKI certificates can be used to encrypt and digitally sign sensitive e-mail messages, to encrypt files, to authenticate a smartphone to a VPN, to secure a web site over HTTPS, and for other purposes.

The certificate authority (CA) is at the top of the hierarchy, and it can have subordinate CAs, such as in a large organization where each region may want its own CA. Subordinate CAs are sometimes called registration authorities (RAs). Finally, the actual PKI certificates are issued by either the CA or a subordinate CA, as pictured in Figure 6-14.

Figure 6-14  PKI hierarchy

You can install your own CA within your organization, which can then issue self-signed PKI certificates as you see fit. Certificates can be manually requested and issued or automatically issued, which is possible using Microsoft Group Policy.

The root, or top-level, CA should be kept offline, because if it is compromised, so, too, are all certificates issued within that hierarchy.

Instead of an internal CA, you can also pay a fee and acquire PKI certificates issued to third-party trusted CAs on the Internet, such as Amazon, Google, DigiCert, and Symantec (formerly Verisign), to name a few.

PKI Certificate Contents

The certificate itself, also called an X.509 certificate, can be used as a file (ideally password-protected), or it can be burned into a magnetic strip or smartcard. But what exactly is stored in a PKI certificate?

When a certificate is issued by a CA or an intermediary CA, a template is used that contains details on what should be stored in the certificate. Common items in the certificate (along with examples) include the following:

•   Serial number

•   Subject name

•   User e-mail address, fully qualified domain name (FQDN) of web site

•   Unique mathematically related public and private key pair

•   The private key must be kept secret, and though it can be stored with the certificate, technically it is stored safely on the device in a key store, not directly within the certificate itself

•   Certificate use

•   E-mail or file encryption, code signing for developers

•   Digital signature of CA along with signature algorithm used

•   Date of issuance and expiration date

•   Certificate can no longer be used once it expires

The certificate can be exported with particular attributes, such as when a certificate is exchanged with other users for e-mail encryption. Encrypting an e-mail message requires the public key of the message recipient(s). So in this case, the recipient exports only the public key portion of the certificate and provides it to the sender. The mathematically related private key is used by the recipient to decrypt the message.

SSL and TLS

Secure Sockets Layer (SSL) is a network security protocol that was developed in the 1990s by Netscape. Like its successor, Transport Layer Security (TLS), SSL provides encryption and authentication between communicating devices over a network. TLS version 1.3 is the latest version as of this writing.

CAUTION   Don’t use SSL or TLS versions 1.0 and 1.1; they are deprecated because of many known security vulnerabilities.

HTTP web servers use TCP port 80 for unencrypted connections and port 443 for HTTPS encrypted connections (the port numbers may vary, but these are normally used). The same is true for other higher level protocols such as Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP3), and so on. Whether you use SSL or TLS, a PKI certificate is required.

When the option is available, you should use the newest version of TLS if it is supported by the application. Modify the registry on a Windows server to disable SSL 3.0 and enable TLS. Using OpenSSL with Linux also supports TLS; this is configured per application (web site, web browser, and so on).

IPSec

Even though it’s built into IPv6, Internet Protocol Security (IPSec) also works with IPv4. Contrary to popular belief, IPSec is not used solely for VPNs.

Unlike SSL and TLS, IPSec is not configured for each application. Consider the fact that you need to acquire a PKI certificate and configure both apps to use the certificates if you want to secure an HTTP web server and an SMTP mail server. With IPSec, you can secure network traffic without acquiring a PKI certificate for each individual app or server. IPSec doesn’t even require the use of PKI certificates.

IPSec applies policy settings to computers, and this dictates how it will be used. For example, on a Windows server, IPSec is configured as part of the Windows Firewall under Connection Security Rules. It can be configured to be used where both parties communicating over a network use IPSec to secure network traffic, regardless of the protocol being used.

This is an interesting concept, because all the network traffic within your organization could be encrypted and authenticated using IPSec without your having to configure security for each app or network service. Even ping traffic could be encrypted. Some enterprise networks don’t encrypt internal network traffic, but bear in mind that many threats can cause havoc within a network, so if you have the option, you should encrypt all internal traffic.

Configuring IPSec requires some kind of key for authentication. Figure 6-15 shows key options when configuring Windows Firewall, including using the Kerberos protocol, certificates, and preshared keys.

Figure 6-15  IPSec authentication options

EXAM TIP   You might get exam questions testing your knowledge of authentication protocols. For computers joined to an AD domain, the Kerberos protocol is the best choice for authentication. A preshared key is the weakest option because it is a symmetric key, which means that the same key is used for encryption and decryption. The difficulty with symmetric keys is how to distribute them securely. Knowledge of the symmetric key is all that is required for decryption.

IPSec Tunnel Mode

IPSec tunnel mode is normally used between two endpoint VPN devices, such as a site-to-site VPN over the Internet. It works by encrypting the entire original IP packet (not just the payload) and adding a new IP header so that the transmission can get to the other end of the tunnel.

Tunnel mode can also be used between a client and a server or VPN appliance. In technical jargon, the original IP packet is said to be “encapsulated” in a new IPSec packet.

IPSec Transport Mode

IPSec transport mode doesn’t encrypt the entire original IP packet (headers and payload), but just the payload itself. Communication between devices is protected regardless of the protocol being used.

VPNs

A VPN provides an encrypted, secured connection to a target private network over an untrusted network such as the Internet. VPNs have long been used by people who work from home or who travel, as well as to link sites together over the Internet.

Client-to-site VPNs require client VPN software configured to connect to a VPN appliance in a company screened subnet (or reachable through a reverse proxy in the screened subnet). Once a user authenticates to the VPN, ideally using multifactor authentication, the encrypted tunnel is established and any network traffic between the client and VPN appliance is secured.

Site-to-site VPNs require a VPN appliance at two different network sites. A point-to-point encrypted tunnel is established between the two VPN appliances that link networks together. It can also be used between an on-premises network and a public cloud provider’s network.

The most common types of VPN protocols are

•   Point-to-Point Tunneling Protocol (PPTP)

•   Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec)

•   Secure Sockets Layer (SSL) tunnel

If the VPN appliance is using an L2TP/IPSec VPN, the VPN client software must be configured accordingly. SSL VPNs have become popular because they use standard HTTPS ports, which are opened in most of today’s firewalls.

Intrusion Detection and Prevention Systems

Intrusion detection (ID) and intrusion prevention (IP) play big roles in securing hosts and networks by looking for anomalous, or suspicious, activity that doesn’t match normal network usage patterns.

Host Intrusion Detection System

A host intrusion detection system (HIDS) detects suspicious activity related to a specific host, such as an HTTP web server running multiple web apps. By monitoring network traffic into and out of the host, operating system, and application logs, the ID engine can determine whether something is out of the ordinary.

A HIDS must be configured to look for abnormalities; sophisticated solutions can monitor host activity over time and generate a baseline of normal activity. One benefit of a HIDS is that it can read traffic that is encrypted over the network; once the host decrypts that traffic, it can be examined. ID systems can send alert notifications to technicians, who can then take further action.

Network Intrusion Detection System

A network intrusion detection system (NIDS) is a standalone appliance that watches network activity, looking for anomalies. For this to work, the NIDS must be able to see all of the traffic. Security information and event management (SIEM) software provides a centralized repository for logs, audit events, and security device alerts to detect and notify admins of suspicious activity. For example, attackers can enable a backdoor on a compromised device that will provide them with undetected access for long periods of time; this problem is often solved by applying patches, but SIEM solutions may detect repeated abnormal login times to a server.

In a network-switched environment, switch administrators will have to configure the switch to copy all packets to the port to which the NIDS is connected. Here’s an example: Using the open-source Snort IDS, rules are created that determine what gets monitored. The Snort command line or configuration file specifies output log file locations for alert messages. To assign a unique Snort ID (sid) and to generate an alert for ICMP traffic from any host to any host, our Snort rule is configured as follows:

alert icmp any any -> any any (msg:"ICMP Traffic Detected";sid:3000003;)

Intrusion Prevention Systems

Intrusion prevention systems (IPSs) extend the functionality of IDSs by taking steps to prevent further damage when malicious activity is detected. Like IDSs, IPSs must be tuned for the specific host (HIPS) or network (NIPS) environment they will be monitoring. An IPS can, for example, detect malware and remove or prevent the infection from spreading. Another example is excessive packets received from a remote network in a short amount of time; an IPS could block further traffic from that network address.

Hardening

Hardening a server reduces its attack surface. In a data center, server hardening is done through a centralized configuration and not on each and every individual server. Server operating system images can be hardened so that newly installed servers are reasonably safe right from the start. The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-123, “Guide to General Server Security,” provides guidance for securing servers including logging, patching, access control, backups, and more. You can view this document at https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-123.pdf.

Keeping systems secure is an ongoing process. Periodic vulnerability scans should be conducted to detect weaknesses in hardware, operating systems, and applications. Some vulnerability scanners can automatically correct or remediate weaknesses; others will only report the discovered vulnerabilities. Often, patching and following secure configuration guidelines reduce vulnerabilities.

Operating System Hardening

There’s no reason why a HIDS or HIPS shouldn’t be implemented on each and every server. It makes sense for each server to have a dedicated component that watches for malicious activity, including malware, and either notifies administrators or takes some kind of corrective action.

The good news is that most modern server operating systems do not have much installed by default, so right away you’re off to a good start. The following list contains common items addressed when hardening servers:

•   Apply firmware updates to BIOS/UEFI RAID controllers.

•   Set a UEFI/BIOS boot password to prevent changing the boot order.

•   Enable CPU No-eXecute (NX bit) at the BIOS level.

•   Prevent certain memory pages from running executable code.

•   Stop buffer overflow attacks.

•   Lock the server chassis or rack case.

•   Disable Wake-on-LAN.

•   You don’t want servers brought down for maintenance to be remotely awakened.

•   Apply operating system updates.

•   Apply application software updates.

•   Follow OS and application configuration best practices.

•   Enable multifactor authentication.

•   Install a HIDS/HIPS component.

•   Keep your antimalware solution up to date.

•   Configure a host-based firewall.

•   Block unused ports.

•   Disable unused services and daemons.

•   Disable unused accounts.

•   Rename or disable default accounts.

•   Enable auditing or logging related to the IT workload.

•   Copies of log entries should be forwarded to a different host.

•   Log forwarding is possible using Windows Event Log Forwarding and Linux syslog forwarding.

•   Audit user logins, group membership changes, user file system activity, including file deletion, database row modifications, and so on.

•   Follow the principle of least privilege when assigning rights and permissions.

•   Enable network encryption for all traffic if possible (encrypt data in transit).

•   Traffic on internal networks should also be encrypted (consider using IPSec).

•   Encrypt data at rest on all storage media.

•   Plan for hardware failure (power supplies, disks) by configuring redundancy such as disk RAID levels.

None of these items should be a surprise, especially since most organizational security policies will insist on these configurations.

Hardware Hardening

In addition to applying the latest firmware updates for server hardware, you must apply firmware updates for network infrastructure and network devices: this is crucial. Disable or unplug hardware that isn’t required. Hardware to consider includes the following:

•   Routers

•   Switches

•   SAN switches

•   SAN backup devices

•   Disk arrays

•   Network printers

•   VPN appliances

•   Firewall appliances

•   Wireless access points

•   Wireless routers

When it comes to devices such as network switches, you’ll need to consider an entire set of configuration items when hardening. For instance, unused switch ports should be disabled; switch ports should not allow numerous MAC addresses, which could indicate a VLAN MAC flooding attack; remote Telnet administration should be disabled in favor of SSH; and so on.

Application Hardening

Many hardening techniques that apply to hardening server OSs also apply to application hardening. You need to have a strong knowledge of the application before locking it down so that you can keep it functional. Of course, if you don’t need an application or service running, don’t even install it—or, at the very least, disable it.

Patching is always crucial, whether for operating systems, drivers, or specific application patches. For example, plenty of Microsoft Office memory corruption vulnerabilities have been addressed by patches. To be fair, the open-source LibreOffice has had its share of vulnerabilities, often in the form of buffer overflows. Ideally, you will have a sandbox environment where you can test patches before they are deployed to a production environment (virtualization makes this easy).

Hardening an application also includes modifying its default configuration. For instance, you might choose to disable collaborative sharing features in an app to prevent sensitive data leakage, or you might configure macro security in a spreadsheet to enable only trusted digitally signed macros to execute. You can use security configuration baselines to compare current device configurations to detect changes, and, depending on the tool being used, revert configurations back to a secure state.

Using PowerShell scripts for automating Windows Server administrative tasks is becoming more and more popular, but malicious users can also cause damage or steal data if they can get a script to run on a device. One way to allow only digitally signed scripts to run is by configuring the script execution policy to run only digitally signed scripts from a trusted signer, as shown in Figure 6-16.

Figure 6-16  Hardening the PowerShell script execution policy

Data Security

Data, however it is being used, should always be encrypted when possible using strong encryption ciphers. Encrypted data presents another layer of defense that malicious users have to overcome. Data can exist in various states:

•   Data in use  Currently being processed

•   Data in motion  Transmitted over a network

•   Data at rest  Stored on media

Encryption requires at least one key. A symmetric key is used to encrypt and decrypt. With asymmetric encryption, a pair of keys is used, one for encryption and one for decryption. PKI certificates contain related public and private key pairs—so, for example, if data is encrypted with the public key, only the related private key can decrypt the data.

Data loss prevention (DLP) tools can increase an organization’s control in preventing sensitive data from leaving the organization or intellectual property becoming available to unauthorized users. This means labeling data so it can be handled in accordance with DLP policies. Examples include adding digital watermarks to documents or photos to prevent unwanted publication, disallowing files from being copied to removable media to prevent unwanted duplication, or preventing e-mail messages with sensitive file attachments from being sent to recipients outside of the organization.

DLP is designed to reduce or eliminate data breach incidents. It can be configured with products such as Microsoft Exchange for e-mail, as well as in the cloud using Azure Information Protection (AIP). These days, organizations must comply with data breach notification laws to disclose security breaches to affected stakeholders.

Data and Mobile Devices

Mobile device use in a business environment presents an enormous threat. Centralized management of mobile device options is absolutely paramount, including logical partitioning, or containerization. Business apps, settings, and data must be kept separate from users’ personal apps, settings, and data if users will be accessing personal mobile devices onsite.

A centralized data leakage prevention tool must be used to ensure, for example, that sensitive file attachments cannot be stored on removable thumb drives or shared on social media sites.

Geofencing is another great way to control where mobile device apps can be used. In retail, for example, potential customers in a mall may have access to coupons online only when they are inside the mall. On the security side, a mobile device app that can access sensitive information may be usable only within certain physical boundaries. Signal blocking can be achieved in the case of a seized mobile device by using a Faraday bag to prevent the mobile device from transmitting or receiving data.

Encrypting Data at Rest

Organizations must discover and label data in their possession. Highly valued data, such as customer financial records, compared to product documentation, must be prioritized when it comes to applying security controls to protect that data. The business impact of losing highly valued data plays into the need to address security during the relevant data’s life cycle, including creation, storage, use, sharing, and eventually archiving and deletion. The annual cost of applying security controls to protect or replace data must not exceed the value of that data.

Encryption is one type of security control that can protect sensitive data. Encryption of data at rest prevents unauthorized access to stored sensitive data. We talked about encrypting data as it gets transmitted over the network; here, the focus is on protecting data when it’s stored on media. The physical location of data can also determine which data privacy laws are applicable. For example, a subpoena could be issued to a cloud provider in a specific region where the provider is required to provide access to stored data.

The Payment Card Industry Data Security Standard (PCI-DSS) requires (since 2006) merchants handling customer payment card information to encrypt not only data transmission on a network but also data at rest; otherwise, they face steep fines. In 1996, the U.S. government enacted the Health Insurance Portability and Accountability Act (HIPAA), which requires that private health information be protected. There are many such data protection requirements for different types of data throughout the world.

Personally identifiable information (PII), also referred to as individually privileged information, refers to any information that uniquely identifies an individual, such as a credit card number or home address. Many laws, regulations, and security standards require PII data to be labelled as such and encrypted.

Windows BitLocker

Windows client and server operating systems support the BitLocker encryption feature (the client must be running the Enterprise Edition of the OS). BitLocker encrypts entire disk volumes and removable USB thumb drives. Group Policy settings can be configured to require BitLocker encryption on certain types of drives and to prevent data writes to unencrypted drives.

The Trusted Platform Module (TPM) is a firmware standard built into most laptop, desktop, and server motherboards. TPM can store cryptographic keys used for encrypting and decrypting BitLocker disk volumes, and it can also detect unauthorized system startup modifications such as changes to the boot sequence. If a motherboard fails, the decryption key would be unavailable even if the disk drive were moved to another computer, so it’s important to store decryption and recovery keys in a safe location.

If a malicious user were to steal BitLocker-encrypted hard disks or thumb drives, the data would be inaccessible without the decryption key. You can see BitLocker configuration options in Figure 6-17.

Figure 6-17  Windows BitLocker settings

Other third-party disk volume encryption tools can be used on Windows servers, including Symantec Endpoint Encryption and Sophos SafeGuard Enterprise, to name a few.

Windows Encrypting File System

Individual files and folders can be encrypted to provide data confidentiality. Microsoft has long included the Encrypting File System (EFS) within its Windows operating system. EFS ties encrypted files and folders to specific users (unlike BitLocker disk volume encryption). Encryption and decryption are possible using the GUI as well as the cipher.exe command line tool.

The first time a Windows user encrypts a file using EFS, a PKI security certificate is automatically generated if the user doesn’t already have one on the machine. The certificate contains a unique public and private key pair for the user that is employed for EFS encryption and decryption.

Technically, EFS uses a bulk encryption key, a file encryption key (FEK), to encrypt blocks of data. The user’s public key (from their PKI certificate) is used to encrypt the FEK, which is stored with the file. Each encrypted file has a different FEK. To decrypt files, the user’s private key (from their PKI certificate) reveals the FEK, which in turn decrypts the blocks of data.

The user PKI certificate must be backed up to a safe location. EFS data recovery agents can be configured to grant administrators the ability to decrypt user EFS-encrypted files. In a Microsoft AD environment, the domain Administrator account can decrypt files on any station joined to the domain.

Files can be encrypted using the following command, where /e means encrypt:

cipher.exe /e D:\Projects\Project_A.txt

OpenSSL

Some Linux distributions include the openssl package, which can, among other things, encrypt files. Your chosen Linux distribution may first require a package to be installed before file encryption is possible using OpenSSL.

To encrypt a file, use this command:

openssl enc -aes-256-cbc -in project_b.txt -out project_b_encrypted.txt

To decrypt a file, use this command:

openssl enc -d -aes-256-cbc -in project_b_encrypted.txt -out project_b_decrypted.txt

Figure 6-18 shows the unencrypted contents of the project_b.txt sample file (test data) and the contents of the encrypted version of the same file.

Figure 6-18  Viewing unencrypted and encrypted text file content in Linux

Tape Encryption

Even with the popularity of cloud backup solutions, tape is still widely used for data backup purposes. It’s common practice for backup tapes to be rotated (reused) on a periodic basis, but when they contain a fresh data backup, they’re often stored offsite for added security.

Tape media normally contains sensitive information and should be encrypted in case the tapes fall into the wrong hands. Data classification makes it easy to identify data with high value to the organization and to apply life cycle policies, such as determining what needs to be encrypted and what does not, as well as how long data should be retained in accordance with laws or regulations.

Today’s enterprise servers tend to use storage area network (SAN) storage. Having an enterprise-class SAN means having SAN-based backup solutions, which are far more efficient than having a backup solution for each server and its local disks. In addition to storing backups offsite, onsite tapes can be stored in a safe.

Several considerations are related to SAN-based tape backup security:

•   Which user account performs backups  Root or Administrator?

•   Scripts are normally used before and after backup  Are malicious scripts present?

•   When encryption occurs  Does it occur during or after backup?

•   The human element  Have thorough background checks been performed on backup administrators?

•   Reliability  Is the offsite tape storage provider trustworthy?

Compliance with data protection laws often drives the data backup policy within an organization, including encryption requirements. Remember that encryption requires keys; proper key management is crucial to decrypt data when needed.

Secure Media Disposal

Deleting files (soft wiping) from storage media doesn’t remove it permanently. Even the casual Windows user knows to check the Recycle Bin for files that have been mistakenly deleted. Even repartitioning a drive and copying files to it doesn’t necessarily mean you can’t restore some of the old data from the media. Imagine being the head of IT for a medical practice that only repartitioned hard disks from old internal PCs before repurposing the PCs to external entities such as schools and charities. It has happened!

Disk Scrubbing

Disks don’t get dirty and therefore don’t need to be scrubbed for cleanliness. Scrubbing in this context means making it as difficult as possible to retrieve data previously stored on the media. This is done by writing useless random data to the disk in multiple passes (called a hard wipe).

Government laws and regulations in some parts of the world require that specific disk scrubbing solutions be used to ensure that no data remains, and this can influence organizational security policies related to media disposal and destruction. Figure 6-19 shows a screen from the Hard Disk Scrubber from Summit Computer Networks. Zeroing out all sectors on a disk is a common method of wiping the disk to minimize the possibility of data recovery. This technique writes a zero byte to all storage locations on the disk.

Figure 6-19  Disk scrubbing

Physical Destruction

Organizational security policy documentation, driven by laws or regulations, could require the physical destruction of storage media. An often crucial and overlooked aspect of destroying storage media is sorting to ensure that sensitive storage devices no longer being used are the ones that get destroyed. There have been cases of bad sorting, which have, for example, resulted in sensitive Canadian military personnel information being exposed—not a great salute for people who put their lives on the line for their country.

For hard disk drives (HDDs), one way to make sure data cannot be recovered is to drill physical holes into hard disk platters. Degaussing is another technique that can be applied to HDDs; data becomes unrecoverable after a high-intensity magnetic field rearranges data on the drive. USB flash storage media is solid state, so degaussing does not apply, but USB storage devices can be crushed or incinerated. Physical shredding using an industrial shredder can also be effective.

NOTE   Be sure to update company asset and change management solutions to reflect the decommissioning of equipment.

Remote Wipe

Mobile device management (MDM) solutions enable the centralized management of mobile devices. MDM tasks include

•   Software deployment

•   Update deployment

•   Device configuration

•   Device partitioning

Administrators can remotely wipe lost or stolen smartphones to protect sensitive data and apps, as shown in Figure 6-20. Bear in mind that a single compromised mobile device can be used by attackers to infiltrate a network and bring down or compromise servers, so remote wiping is a big deal. The wipe can reset the entire device to factory settings (a full wipe), or it can wipe only corporate apps and data (a selective wipe).

Figure 6-20  Microsoft Intune device wiping options

Selective wipes make sense in bring-your-own-device (BYOD) scenarios, where employees use their personal mobile devices to perform work tasks. Many organizations pay a small monthly stipend to employees to offset the cost of the devices.

Hands-on Exercises

Exercise 6-1: Set NTFS File System Permissions

1.   Ensure that you are logged into Srv2019-1 with the Domain Administrator account (Fakedomain\Administrator) with a password of Pa$$w0rd172hfX.

2.   Click the Start button, enter Active, and click Active Directory Users And Computers when it is displayed.

3.   In the left navigator, right-click fakedomain.local and choose New | Organizational Unit.

4.   Enter ProjectManagers for the name and click OK.

5.   Expand fakedomain.local in the left navigator, right-click ProjectManagers, and choose New | User.

6.   Enter User for the first name, One for the last name, and uone for the user logon name. Click Next.

7.   For the password, enter Pa$$w0rd172hfX. Uncheck the option for changing the password at next logon; then click Next and then Finish.

8.   Right-click ProjectManagers and choose New | Group. Name it PMs. Accept all other defaults.

9.   Add User One as a member of the PMs group. Double-click the PMs group within the ProjectManagers organizational unit, and then click the Members tab, click Add, and enter user one. Click OK twice.

10.   Start Windows Explorer. Create a folder called Projects on C:\ by right-clicking Local Disk (C:) in the left navigator and choosing New | Folder.

11.   From the Start menu, enter Notepad. Click Notepad to launch the application. Enter some random text in the Notepad window.

12.   Choose File | Save, and enter the name C:\Projects\Project_A. Close Notepad.

13.   In Windows Explorer, right-click the Projects folder and choose Properties.

14.   Open the Security tab, click Edit, click Add, and enter PMs. Click OK. Notice the PMs group is automatically allowed the Read & Execute, List Folder Contents, and Read permissions. Click the box under the Allow column for Modify to enable the check mark, and then click OK twice.

15.   Open the Projects folder. Then right-click Project_A and choose Properties.

16.   Open the Security tab, click the Advanced button, and click the Effective Access tab. Then click Select A User and enter user one.

17.   Click OK and then click View Effective Access. Scroll down the list and notice the individual permissions allowed (green check mark). Click OK. Click OK to close Project_A properties. Leave the virtual machine running.

Exercise 6-2: Set Shared Folder Permissions

1.   On Srv2019-1, start Windows PowerShell from the Start menu.

2.   Enter the following:

new-smbshare -name Projects -path c:\projects -readaccess "fakedomain\PMs"

Then press ENTER. This grants only read access to members of the PMs group.

3.   Verify step 2 in Windows Explorer by right-clicking C:\Projects, choosing Properties, clicking the Sharing tab, clicking Advanced Sharing, and then clicking Permissions. You will see the PMs group with Read access. Click Cancel twice.

4.   Click the Security tab, click the Advanced button, and then click the Effective Access tab. Click the Select A User link, enter user one, and click OK.

5.   Click View Effective Access. Scroll down and notice that only read and listing permissions are available. When you combine NTFS and share permissions, the most restrictive permissions prevail. Close all open windows and leave the virtual machine running.

Exercise 6-3: Set File System Permissions in Linux

1.   Ensure that you are logged into Ubuntu-1 as uone with a password of Pa$$w0rd172hfX. Precede each command on the same line with sudo followed by a space. Press the ENTER key after you issue each command.

2.   Enter cd / (without the sudo prefix in this case, because cd is an internal command—it is not its own binary file).

3.   Enter mkdir projects. If prompted for the uone password, enter Pa$$w0rd172hfX. Then enter ls -ld projects. Notice that the default group permissions for the root group are set to r-x (read and execute). The owning group is in the fourth column—in this case, the second occurrence of “root.” The third column lists the owning user.

4.   Enter groupadd sales.

5.   Enter useradd utwo -G sales. User Two is now a member of the sales group.

6.   Enter chgrp sales /projects. Then enter ls -ld projects. Notice that the default group is now sales (fourth column) and members of the sales group now have r-x (read and execute) access to the projects folder.

7.   Enter chmod g+w /projects. This adds the write permission for the group assigned to projects. Enter ls -ld /projects. Notice that the group permissions for sales are now rwx (read, write, and execute). Leave the virtual machine running.

Exercise 6-4: Use EFS to Encrypt Files in Windows

1.   On WinSrv2019-1, open a command prompt and enter md c:\budgets.

2.   Start Notepad and type random text into the new file. Name and save the file as c:\budgets\budget1 and close Notepad.

3.   From the command prompt, mark the budgets folder to encrypt future files (/e) and also encrypt the entire subdirectory structure (/s). Enter cipher /s:c:\budgets /e.

4.   Enter cipher c:\budgets\budget1.txt and notice the “E” to the left of the budget1.txt filename; this shows that the file is now encrypted using EFS. Other users will be unable to access this file.

Exercise 6-5: Use OpenSSL to Encrypt Files in Linux

Precede each command on the same line with sudo followed by a space. Press the ENTER key after you issue each command.

1.   In Ubuntu-1, enter mkdir /projects2.

2.   Enter nano /projects2/project_b.txt.

3.   Enter “This is a sample file”. Press CTRL-X, Y and then ENTER to write and quit out of the new file.

4.   To encrypt the new file, enter

Then enter Pa$$w0rd172hfX when prompted.

5.   Delete the original file by entering rm /projects2/project_b.txt. Enter cat /projects2/project_b_encrypted.txt, and notice that the file content is encrypted.

6.   Enter the following:

Then enter Pa$$w0rd172hfX when prompted.

7.   Enter cat /projects2/project_b_decrypted.txt to view the file contents. The file contents are now readable because the file is not encrypted. Leave the virtual machine running.

Exercise 6-6: Use iptables to Set Firewall Rules in Linux

1.   From a command prompt on Srv2019-1, enter ping 192.168.1.201. This is the IP address of the Linux server. You should get a response.

2.   On Ubuntu-1, enter iptables -A INPUT -p icmp -j DROP to block all incoming ICMP traffic.

3.   From a command prompt on Srv209-1, enter ping 192.168.1.201 once again. This time you should not get a response, because ICMP traffic is blocked. The ping command uses ICMP.

4.   From a terminal prompt on Ubuntu-1, enter iptables -F to flush (remove) rules.

5.   From a command prompt on Srv2019-1, ping the Linux server again. You should get a response. Keep Srv2019-1 running.

Exercise 6-7: Enable Encrypted Communication on a Windows IIS Web Server

1.   On Srv2019-1, start Server Manager.

2.   On the left, click Local Server. In the right panel, select On, next to IE Enhanced Security Configuration. Select both Off options and click OK.

3.   Click Manage and then click Add Roles And Features.

4.   Accept defaults and keep clicking Next until you reach the Select Server Roles screen.

5.   If IIS is not already installed, add a check mark next to the Web Server (IIS) option, and if prompted to install tools, click Add Features. Continue through the wizard, accepting defaults by clicking Next

6.   Start Internet Explorer on Srv2019-1. If prompted to accept recommended settings, do so. In the address bar, enter http://srv2019-1.fakedomain.local. The IIS default web page should be displayed. Close Internet Explorer.

7.   From Server Manager, click Manage and then click Add Roles And Features.

8.   Accept the defaults and keep clicking Next until you reach the Select Server Roles screen.

9.   Add a check mark to Active Directory Certificate Services. This role allows the creation of a PKI hierarchy. If prompted to add additional roles and features, click Add Features. Continue through the rest of the wizard, accepting defaults until you reach the end of the wizard. Then click Install and then Close.

10.   In Server Manager, click the flag notification icon in the upper right. Click the Configure Active Directory Certificate Services On This Server link to complete the Certification Authority configuration. Proceed through the wizard and select the Certification Authority check box on the Select Role Services To Configure screen. Create an Enterprise CA, and accept the defaults for the remainder of the settings. Click Close.

11.   From a command prompt, enter mmc, and press ENTER.

12.   Choose File | Add/Remove Snap-in. Select Certificates on the left, click Add, choose Computer Account, and then click Next, then Finish, and then OK.

13.   In the left navigator, expand Certificates (Local Computer). Right-click Personal and choose All Tasks | Request New Certificate.

14.   Click Next twice. Add a check mark for the Domain Controller certificate template listing and click Enroll. This creates a PKI certificate for your server that can be used to secure the IIS web site. Click Finish to close the Certificate Enrollment window.

15.   From the Start menu, enter IIS. When Internet Information Services (IIS) Manager is displayed, click it.

16.   On the left, expand your server name, and then expand Sites.

17.   Right-click Default Web Site and choose Binding.

18.   Click Add, and from the Type drop-down list, choose https.

19.   From the SSL Certificate drop-down list, choose Srv2019-1.fakedomain.local and click OK.

20.   Select the http binding from the list and choose Remove. Click Yes, and then close the dialog box.

21.   Start Internet Explorer, enter http://srv2019-1.fakedomain.local in the address bar, and then press ENTER. After a few moments, you will see a “Can’t reach this page” error message, because we removed the http binding. If it displays the web page, you may need to clear your IE browser history by pressing ALT-T and then choosing Delete Browsing History.

22.   In the address bar, enter https://srv2019-1.fakedomain.local (notice the https). The web page opens over an HTTPS connection.

Chapter Review

This chapter covered various aspects of locking down computer environments—including physical security, server hardening, and data encryption.

Physical Security

Restricted access to facilities is possible using fencing, lighting, security guards, guard dogs, gates, mantraps, door-locking mechanisms, and security solutions such as motion detection systems. Large data centers replicate data to other data centers to ensure high availability of IT services and data. Individual servers as well as server room racks have locking mechanisms to prevent equipment tampering.

Modern access and payment cards, such as RFID chip cards and smartcards, have embedded circuits that can transmit data wirelessly.

Authentication

User, device, and service authentication falls into three categories:

•   Something you know

•   Something you have

•   Something you are

Multifactor authentication uses at least two of these categories. Authentication can be centralized using identity federation.

Logical Access Control

Users can be placed into groups or roles, which are granted permissions to resources. Some server operating systems support conditional access based on user, device, and resource attributes.

Windows administrators assign NTFS and share permissions to control network access to files. The most restrictive permission applies when combining share and NTFS permissions. Linux server administrators can use the chmod command to work with file system permissions.

Network Security

Network Access Control (802.1X) limits which users and devices can connect to a network through edge devices such as network switches, wireless routers, and VPN connections. Edge devices (RADIUS clients) should be configured to forward authentication requests to a central RADIUS authentication server.

VLANs organize network nodes into virtual networks, even within a single physical switch. This can be done by MAC or IP address, by grouping physical switch ports together, and so on. VLANs enable administrators to isolate network traffic for performance and security reasons.

Firewalls

Firewalls regulate traffic into and out of networks and individual hosts. Packet-filtering firewalls examine packet headers, looking at characteristics such as source and destination IP address, port address, and protocol type. Deep packet inspection firewalls examine payload content beyond packet headers.

Reverse proxy servers are listeners on a publicly visible network that forward traffic to a specific network service on an internal protected network.

Network services, firewalls, and proxy servers must be placed in the correct network security zone. Screened subnets enable the safe placement of publicly visible servers while protecting systems on internal networks. Firewalls control traffic between the Internet and the screened subnet and between the screened subnet and internal networks.

PKI

Public Key Infrastructure is a hierarchy of security certificates issued to users, devices, or services. The certificates contain keys that provide security in the form of authentication and encryption. Certificate authorities issue certificates.

PKI certificates contain numerous items such as the subject name, a serial number, and a unique public and private key pair. The private key is sensitive and must not be shared with other parties. Certificates have an expiration date, after which they can no longer be used.

SSL and the newer TLS provide authentication and encryption for network services such as web sites. Keys from PKI certificates make this possible; in most configurations, only the server needs a PKI certificate, not each connecting client.

IPSec

IPSec is used to authenticate and encrypt network transmissions using either transport or tunnel mode. Tunnel mode is used for point-to-point connections such as with VPNs. Transport mode can be used for all devices on a LAN to encrypt network traffic that normally may not support encryption.

IPv6 requires IPSec; it is optional for IPv4. On Windows servers, IPSec is configured through the Windows Firewall using Connection Security Rules.

VPNs

Virtual private networks enable encrypted connections to a private network over an untrusted network. Common VPN types include PPTP, L2TP/IPSec, and SSL. Different types of VPNs require different ports to be open in firewalls—SSL VPNs are firewall friendly because they use TCP port 443, which is also used by HTTPS.

VPN clients require that software be configured to connect to the VPN. All traffic between the client and VPN appliance is encrypted. The VPN appliance decrypts received traffic and sends it to the internal network.

Intrusion Detection and Prevention

An intrusion detection system (IDS) sends administrative alerts when suspicious activity is detected. Network traffic, log files, and local operating system process execution are tracked for anomalies. An intrusion prevention system (IPS) takes this a step further by taking action to stop the activity from continuing.

IDS and IPS solutions can run on a specific host or on the network to view all network traffic, if placed properly. Rules must be configured to ensure that IDS and IPS solutions are effective in a specific network environment.

Hardening

Hardening applies to networks, servers, and applications, and it includes activities such as disabling unused ports and services, applying patches, encrypting data in transit and at rest, and so on.

Logging must be enabled on all devices, and log copies should be forwarded to other hosts in case a device is compromised and logs are cleared. Firmware updates should also be a part of hardening, along with setting CMOS passwords on servers and ensuring that antimalware (antivirus) solutions are kept up to date. Storage area network devices, VPN appliances, routers, switches, and wireless routers should also be hardened.

Data Security

Encryption is used to ensure that only authorized users can access sensitive data. When the same key is used for encryption and decryption, it is called symmetric encryption; when different (yet mathematically related) keys are used, it is called asymmetric encryption. PKI certificates contain related public and private key pairs.

Data encryption can be applied to data in use, data in transit, and data at rest. Ideally, encryption should be used everywhere (networks, servers, backup tapes, desktops), but encryption must be enforced on removable media and mobile devices.

Secure Media Disposal

Techniques such as disk scrubbing (software) can overwrite storage media to prevent data retrieval. Physical techniques such as physical media destruction ensure that sensitive data cannot be retrieved.

Lost or stolen mobile devices can either be fully wiped or selectively wiped. Selective wiping removes only company apps, settings, and data.

Questions

1.   Which physical security control prevents tailgating?

A.   RFID card

B.   Access control vestibule

C.   Security guard

D.   Fencing

2.   Which modern short-distance wireless standard is used for payment cards and terminals?

A.   NFC

B.   Bluetooth

C.   Wi-Fi

D.   4G

3.   Which term is used to describe the act of tricking people into divulging sensitive information?

A.   Threat engineering

B.   Mailing

C.   Scanning

D.   Social engineering

4.   Your VPN requires multifactor authentication. Which of the following solutions should you use?

A.   Smartcard, PIN

B.   Username, password, PIN

C.   Username, PIN

D.   Password, PIN

5.   Your network consists of multiple web applications. To connect to each application, a user e-mail address and date of birth are required. What should you do?

A.   Direct users to enter their e-mail address and date of birth when connecting to each web app.

B.   Configure user claims with identify federation, and configure the web apps to trust the identity provider.

C.   Configure device claims with identify federation, and configure the web apps to trust the devices.

D.   Issue PKI certificates to users, and configure the web apps to trust user PKI certificates.

6.   Which VPN authentication tool uses a changing numeric code synchronized with the VPN appliance?

A.   Key fob

B.   USB thumb drive

C.   Smartcard

D.   PKI certificate

7.   Which of the following statements regarding Active Directory groups is false?

A.   Permissions management is simplified.

B.   Groups can be nested.

C.   Group membership changes take effect while affected users are logged in.

D.   Groups can contain computers.

8.   Hussein needs access to budget files stored on a file server in a folder called Budgets. He is a member of the Managers group. The Managers group has been allowed read, read & execute, list folder contents, and write permissions. Hussein complains that he receives an “Access denied” message when he tries to delete budget files. What should you do?

A.   Decrypt the budget files.

B.   Grant the Managers group write permissions on each individual file.

C.   Grant the Managers group modify permission to the budgets folder.

D.   Add Hussein as an EFS data recovery agent.

9.   Trinity is a member of the Executives group, which has been granted the read permission to a shared folder called Expenses. Trinity is also a member of the Site A group, which has been granted the NTFS read and write permissions to the Expenses folder. What permissions will Trinity have to a file in the Expenses folder?

A.   Read

B.   Read and write

C.   Write

D.   No permissions

10.   Which Linux command is used to set file system permissions?

A.   set-acl

B.   chmod

C.   chperm

D.   set-perm

11.   What type of malware encrypts data files and demands payment before providing a decryption key?

A.   Malware

B.   Trojan

C.   Virus

D.   Ransomware

12.   Which security standard controls port-level access to a network?

A.   802.1X

B.   802.3

C.   802.5

D.   802.11

13.   A smartphone is attempting to authenticate to a RADIUS server through a Wi-Fi router. The Wi-Fi router is configured with WPA2 Enterprise. What term is used to describe the smartphone?

A.   RADIUS client

B.   RADIUS supplicant

C.   RADIUS authenticator

D.   RADIUS consumer

14.   Your network uses four Ethernet switches linked together to interconnect 80 computers. Ten of the computers are used by the accounting department and are configured with IPSec. Accounting department computers do not need to communicate with other computers. How can you keep accounting computer traffic more secure?

A.   Encrypt network communications using HTTPS.

B.   Configure a new VLAN for the accounting department computers.

C.   Encrypt network communications using BitLocker.

D.   Configure accounting department computers to use only IPv6.

15.   Which type of VLAN attack overloads switch MAC table memory?

A.   VLAN hopping

B.   Big MAC attack

C.   MAC flooding attack

D.   VLAN spanning tree

16.   Your firewall can filter traffic based on MAC addresses. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

17.   Your firewall can filter traffic based on UDP and TCP port numbers. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

18.   Your firewall can filter traffic based on the contents of packet payloads. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

Questions and Answers

1.   Which physical security control prevents tailgating?

A.   RFID card

B.   Access control vestibule

C.   Security guard

D.   Fencing

B. Access control vestibules (mantraps) close and lock an outer door before allowing you to open an inner door. This prevents other people from tailgating, or slipping in behind you. A, C, and D are incorrect. RFID cards, such as toll bridge pass cards, use radiofrequencies to transmit data wirelessly. Security guards may notice somebody slipping into a secured facility behind you, but that is not their primary job, so it is not the best answer. Fencing does not prevent tailgating.

2.   Which modern short-distance wireless standard is used for payment cards and terminals?

A.   NFC

B.   Bluetooth

C.   Wi-Fi

D.   4G

A. Near-field communication (NFC) is a short-distance wireless standard used often by payment cards and terminals. B, C, and D are incorrect. Bluetooth is a short-range wireless standard used by headsets, speakers, and so on, but it is not used for payment card systems. Wi-Fi is not a short-range system and is not used by payment systems; neither is 4G, a cellular data network standard.

3.   Which term is used to describe the act of tricking people into divulging sensitive information?

A.   Threat engineering

B.   Mailing

C.   Scanning

D.   Social engineering

D. Social engineering involves tricking people into divulging sensitive information. A, B, and C are incorrect. Threat engineering is a made-up term. Mailing is used to send messages. Scanning is performed to gather information about a network.

4.   Your VPN requires multifactor authentication. Which of the following solutions should you use?

A.   Smartcard, PIN

B.   Username, password, PIN

C.   Username, PIN

D.   Password, PIN

A. The smartcard is something you have, and the PIN is something you know—this is multifactor authentication. B, C, and D are incorrect. Usernames, passwords, and PINs constitute a single authentication category—something you know.

5.   Your network consists of multiple web applications. To connect to each application, a user e-mail address and date of birth are required. What should you do?

A.   Direct users to enter their e-mail address and date of birth when connecting to each web app.

B.   Configure user claims with identify federation, and configure the web apps to trust the identity provider.

C.   Configure device claims with identify federation, and configure the web apps to trust the devices.

D.   Issue PKI certificates to users, and configure the web apps to trust user PKI certificates.

B. Claims contain attributes such as e-mail addresses and dates of birth. Identity federation servers provide these digitally signed claims to apps that are configured to trust the identity provider. A, C, and D are incorrect. Users should not have to enter details for each and every app. The required claim attributes are tied to users, not devices. PKI certificates themselves do not provide claims-based authentication.

6.   Which VPN authentication tool uses a changing numeric code synchronized with the VPN appliance?

A.   Key fob

B.   USB thumb drive

C.   Smartcard

D.   PKI certificate

A. Key fobs, also called hardware or software tokens depending on what is being used, have a changing numeric code that must be entered in addition to other credentials for authentication to succeed. B, C, and D are incorrect. USB thumb drives do not provide anything related to authentication; they are used for storage. Smartcards and PKI certificates can be used for authentication, but they do not have a changing numeric code.

7.   Which of the following statements regarding Active Directory groups is false?

A.   Permissions management is simplified.

B.   Groups can be nested.

C.   Group membership changes take effect while affected users are logged in.

D.   Groups can contain computers.

C. Users must log off and log back in for their group membership changes to be in effect. A, B, and D are incorrect. These options are all true; therefore, they do not address the question.

8.   Hussein needs access to budget files stored on a file server in a folder called Budgets. He is a member of the Managers group. The Managers group has been allowed read, read & execute, list folder contents, and write permissions. Hussein complains that he receives an “Access denied” message when he tries to delete budget files. What should you do?

A.   Decrypt the budget files.

B.   Grant the Managers group write permissions on each individual file.

C.   Grant the Managers group modify permission to the budgets folder.

D.   Add Hussein as an EFS data recovery agent.

C. To delete files, users need the NTFS modify permission. A, B, and D are incorrect. The question does not state that files are encrypted, so decryption and recovery agents do not apply. It is clear that the granted permissions (including write) do not allow deletions.

9.   Trinity is a member of the Executives group, which has been granted the read permission to a shared folder called Expenses. Trinity is also a member of the Site A group, which has been granted the NTFS read and write permissions to the Expenses folder. What permissions will Trinity have to a file in the Expenses folder?

A.   Read

B.   Read and write

C.   Write

D.   No permissions

A. When combining share and NTFS permissions, the most restrictive permission applies. B, C, and D are incorrect. Because the most restrictive (the read share permission) applies, the other answers cannot be correct.

10.   Which Linux command is used to set file system permissions?

A.   set-acl

B.   chmod

C.   chperm

D.   set-perm

B. chmod (change mode) is used to set Linux file system permissions. A, C, and D are incorrect. These commands do not exist in Linux.

11.   What type of malware encrypts data files and demands payment before providing a decryption key?

A.   Malware

B.   Trojan

C.   Virus

D.   Ransomware

D. Ransomware encrypts files that infected computers have write access to, and it demands payment before supposedly supplying a decryption key. A, B, and C are incorrect. Malware is a catch-all term; ransomware is more specific. Trojans are a form of malware that appear to be benign but are malicious. A virus is a form of malware that attaches to files.

12.   Which security standard controls port-level access to a network?

A.   802.1X

B.   802.3

C.   802.5

D.   802.11

A. 802.1X is an IEEE standard that defines port-level security mechanisms for devices connecting to a network. B, C, and D are incorrect. 802.3 is the Ethernet standard, 802.5 is the Token Ring standard, and 802.11 defines the Wi-Fi standard.

13.   A smartphone is attempting to authenticate to a RADIUS server through a Wi-Fi router. The Wi-Fi router is configured with WPA2 Enterprise. What term is used to describe the smartphone?

A.   RADIUS client

B.   RADIUS supplicant

C.   RADIUS authenticator

D.   RADIUS consumer

B. In a RADIUS authentication environment, client devices are referred to as supplicants. A, C, and D are incorrect. RADIUS clients are edge devices such as Wi-Fi routers and network switches. RADIUS authenticator and consumer are not valid terms in this context.

14.   Your network uses four Ethernet switches linked together to interconnect 80 computers. Ten of the computers are used by the accounting department and are configured with IPSec. Accounting department computers do not need to communicate with other computers. How can you keep accounting computer traffic more secure?

A.   Encrypt network communications using HTTPS.

B.   Configure a new VLAN for the accounting department computers.

C.   Encrypt network communications using BitLocker.

D.   Configure accounting department computers to use only IPv6.

B. VLANs provide security by isolating network communications. A, C, and D are incorrect. There is no need to encrypt using HTTPS if IPSec is already in use. BitLocker encrypts disk volumes, not network communications. IPv6 by itself would not provide security.

15.   Which type of VLAN attack overloads switch MAC table memory?

A.   VLAN hopping

B.   Big MAC attack

C.   MAC flooding attack

D.   VLAN spanning tree

C. MAC flooding attacks overwhelm the limited switch memory to retain MAC addresses plugged into switch ports, which makes traffic flood to all ports, much like a hub. This means traffic not normally visible becomes visible to all switch ports. A, B, and D are incorrect. VLAN hopping occurs when a malicious user spoofs packet data so that his station can become a member of multiple VLANs. “Big MAC attack” is a marketing slogan coined by a well-known fast-food chain in the 1970s. VLAN spanning tree is not a type of VLAN attack.

16.   Your firewall can filter traffic based on MAC addresses. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

A. MAC addresses are OSI Layer 2 (data link) addresses. B, C, and D are incorrect. MAC addresses do not apply to OSI Layers 3, 4, or 7.

17.   Your firewall can filter traffic based on UDP and TCP port numbers. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

C. Port numbers apply to OSI Layer 4, the transport layer. A, B, and D are incorrect. Port numbers do not apply to OSI Layers 2, 3, or 7.

18.   Your firewall can filter traffic based on the contents of packet payloads. Which term correctly identifies your firewall?

A.   Layer 2

B.   Layer 3

C.   Layer 4

D.   Layer 7

D. Packet payload inspection applies to OSI Layer 7, the application layer. A, B, and C are incorrect. OSI Layers 2, 3, and 4 cannot read packet payload data.

CHAPTER 7

Troubleshooting and Performance Optimization

In this chapter, you will

•   Learn how to apply a troubleshooting methodology to real-world problems

•   Troubleshoot hardware, software, storage, and network problems

•   Apply troubleshooting skills to resolve security issues

•   Optimize server and network performance

Working in IT means solving problems—after all, IT solutions exist to solve business problems. This chapter focuses on how to troubleshoot a wide variety of issues to get people back to being productive as quickly as possible.

Troubleshooting Methodology

Solving IT issues involves a combination of knowledge and experience, plus the application of a sound troubleshooting methodology. When things that once worked no longer work, your first question should always be, “What has changed?” Finding the answer could involve reviewing server log files, consulting with other technicians, and a host of other activities.

Following is the CompTIA Server+ troubleshooting methodology:

1.   Identify the problem.

2.   Establish a theory of probable cause.

3.   Test the theory.

4.   Establish a plan of action.

5.   Implement a solution or escalate.

6.   Verify functionality.

7.   Perform root cause analysis.

8.   Document the solution.

Let’s cover these steps in more detail.

Identify the Problem

Of course, you have to be able to identify exactly what the problem is before you can resolve it. This can be difficult if it involves specific functionality in a custom app, so in some cases the end user can help by further explaining the issue.

Problems are usually reported through a help desk ticketing system, which should be customized to fit your environment. For example, if your company uses Custom App 1 and Custom App 2, these should be selectable from a drop-down list when users are creating a help desk ticket. Help desk systems can also generate reports of tickets and aggregate performance- and security-related items.

Troubleshooting over the phone requires the person reporting the issue to be clear in stating the problem. To gain clarity about the issue, technicians often ask questions of the stakeholders affected by the problem whether they are end users, other technicians, or management. Technicians ask when the problem began appearing or if there were any recent changes—not only to the server itself but to anything in the environment. For example, a change in a switch’s VLAN configuration could affect user access to a server. Technicians also offer suggestions (check your IP address, make sure you’ve clicked this and that) to help identify the issue. Finding the right solution can be tricky if user responses are unclear. If possible, technicians should remotely control the affected station.

EXAM TIP   Watch for troubleshooting questions that indirectly imply that a change was made that results in a problem. Although the change itself may not be the source of the problem, how the change was implemented may be.

Identify the Problem Scope

Problem scope is often overlooked. Who or what is affected by the issue? For example, if the problem is related to Internet connectivity, what does it affect?

•   Only a single server?

•   All devices on a specific network?

•   All devices on all networks?

CompTIA Server+ technicians need to know where to focus their troubleshooting time.

Reproduce the Problem

To solidify your knowledge of the actual problem, it helps if you can re-create the issue to help you determine what went wrong, and where. For example, perhaps the user is required to go through a very specific series of steps on a server to request a PKI certificate, which results in an error, but the problem occurs only when the user chooses a specific certificate template. Reproducing a problem like this may involve changing system configuration settings. For this reason, it’s important that you back up all settings and data prior to making any changes. In some cases, you may need to create a server image (if you don’t already have one) if the server OS becomes inoperable. Configuration management tools such as Microsoft System Center Configuration Manager (SCCM), Chef, Puppet, and Ansible can detect settings drift and remediate them back to a standard baseline configuration.

Check the Log Files

Your company’s security policies will dictate how long log files must be retained. Log retention usually requires log rotation, which involves starting a new log file and compressing and archiving old log files.

There are many types of log files:

•   Windows Event Viewer logs

•   UNIX/Linux logs

•   Normally stored under /var/log

•   Certain apps can store logs under /var/opt

•   Intrusion detection system/intrusion prevention system (IDS/IPS) logs

•   Firewall logs

•   VPN appliance logs

•   Audit logs

•   File system

•   Privilege use

•   Account management

•   Account logon

•   Client operating system logs

•   OS component logs

•   Group Policy

•   Domain Name System (DNS)

•   Dynamic Host Configuration Protocol (DHCP)

Figure 7-1 shows the DNS server log on a Windows server.

Figure 7-1  Windows Server DNS log

Log files should be stored on the device, but in a larger enterprise (especially a data center), log forwarding or a central log viewing tool is critical when logs are stored elsewhere. Server virtual machines running in the cloud can be configured to copy their logs to a central logging system, such as a Microsoft Azure cloud storage account. Figure 7-2 shows log files stored locally on a Linux host.

Figure 7-2  Viewing log files in the Linux /var/log directory

UNIX and Linux support log forwarding through the traditional syslog dameon or its successor, syslog-ng. Filters are created to determine which type of messages are forwarded to other hosts. Windows machines can be configured with event subscriptions to forward certain types of log messages to other hosts. Log forwarding is especially important for edge devices such as VPN appliances or public web sites in a screened subnet. You should make sure there is plenty of space to store logs; otherwise, new log entries may fail to get written.

Viewing or graphing log files over time can demonstrate when a problem appears. The Windows Reliability Monitor history shown in Figure 7-3, for example, can help.

Figure 7-3  Windows Reliability Monitor history

Read the Documentation

Your ability to solve problems quickly requires you to be very organized. If, for instance, you are responsible for maintaining Ubuntu Linux servers, you should have OS documentation readily available, perhaps through an organized list of bookmarks in your web browser.

Hardware documentation for RAID controllers, network printers, hardware firewall appliances, and the like should also be easily accessible. In some cases, if you often work with the same equipment, you should pore over this documentation so that you’re prepared—be proactive!

Implementation documentation is especially important, because it is unique for each organization. You may know everything there is to know about Microsoft Windows servers, but if you don’t know how they are configured, especially in a large network, you may as well know nothing at all! Make sure configuration documentation is secured; you don’t want malicious users getting their hands on this.

Server documentation will define which roles the server houses and how they are configured. From this information, you can also determine the server’s network configuration, firewall settings including specific settings for different zones (different parts of the network with unique firewall requirements), patch history, and other important factors.

Network documentation shows server placement and the role each server plays relative to other servers and network devices. Troubleshooting server issues without specific implementation documentation makes the process long, tedious, and less effective, and it costs much more because it requires more time to fix. It’s worth paying the up-front costs to have proper documentation.

NOTE   Experienced IT consultants will not begin troubleshooting in an unfamiliar computing environment without first taking the time to absorb implementation documentation.

Establish a Theory of Probable Cause

As server technicians, we don’t want to troubleshoot issues by first testing complex solutions; instead, we check the obvious stuff first. Is the network cable plugged in? Does the NIC link indicator light show an active connection? Is the user in a group that should have permissions to access a file? Is the user trying to access a resource from a station not joined to an Active Directory domain where resource access requires this?

This can become tricky when you rely on other parties to provide accurate information about the problem. Where possible, verify that what you are told on the phone or through a help desk ticket is, in fact, correct. For example, a user complaining about being unable to print to Network Printer B may be having problems because she’s unknowingly printing to Network Printer Z. Check the obvious!

With regard to the scope issue, once you begin to formulate a theory of probable cause, you may find that this symptom occurs on other servers or devices too.

Test the Theory

Your organization should have a sandbox testing environment used for IT configuration testing and troubleshooting. This is often a virtual network with multiple virtual machines that mimic the production environment where possible (sometimes easier said than done). Always make sure system configuration settings and data are backed up before you change settings and test theories.

As an example, reconfiguring a host-based firewall (software firewall) on a server to resolve a network service communication issue may break other network services, or it may violate corporate security policy. Back up existing settings first, and follow proper change management procedures. Once your theory is determined to be a viable resolution to the problem, you can formulate the appropriate steps to be taken in the production environment.

Establish a Plan of Action

After you’ve identified the problem and developed of a theory of probable cause, you can test the theory. If the test shows that your theory will be effective in resolving the issue, you need to develop a plan of action. The plan includes detailed steps to take against affected systems, notification of stakeholders, and, for complex problems, an implementation timeline. Simple problem resolution is much less formal and may be entirely in the control of a single technician, who can solve the problem in seconds, such as simply adding a user to a group so that the user can access a file.

Implement a Solution or Escalate

After you have established a plan of action, it must be implemented. Depending on the scope or complexity of the plan, a team of technicians may have to be assembled and notified of their roles. Imagine a network problem created by network switch VLANs that have been incorrectly implemented in a large data center. If the problem exists on hundreds or thousands of switches, many technicians may be required to solve the problem quickly, or, where possible, an automation script may be used.

In some cases, you may need to escalate to another party with the expertise and authority required to resolve the problem. For instance, when troubleshooting Internet connectivity in a branch office, if you determine that network connectivity within your branch office is working, you may escalate the issue to technicians in headquarters, where Internet traffic is centrally routed.

TIP   Remember to change one thing at a time. Changing multiple settings at once makes it difficult to determine exactly which action solved the problem. If a change doesn’t fix the issue, reverse it before moving to other tests.

Verify Functionality

Don’t be tempted to declare victory too quickly! Thorough testing is required to ensure that the problem is indeed solved.

If the problem existed within custom software, you may need to involve a user who works with the custom software daily to test functionality before you can state that the problem has been resolved. Then put preventative measures in place to ensure that the same issue doesn’t occur again. If, for example, the problem resulted from a user tinkering on his Windows workstation, perhaps locking down settings using Group Policy is an appropriate resolution.

From a consulting perspective, the problem isn’t solved until the customer is satisfied. IT service frameworks such as Information Technology Infrastructure Library (ITIL) are based on this foundation.

Perform Root Cause Analysis

When the true cause of an IT problem is known, solutions come much more quickly. At the same time, preventative measures are effective because they are focused.

Conceptually, this is similar to putting out a fire, identifying the source of the fire (such as leaving the stove’s burner on after cooking), and then preventing other fires from occurring (always turn off the burner). In the case of IT, prevention may involve preventing the use of personal USB devices to stop malware infections. In other words, you must treat the root cause and not just the symptoms.

Understand that you may be looking for multiple related root causes, not just one. To prevent similar problems in the future, remember that the key question is “Why?”

The following list offers a sense of how to deal with root cause analysis:

•   Why did machines get infected with malware?

•   Cause: User personal USB devices were not blocked.

•   Solution: Block personal USB device use.

•   Why were newly hired users unable to access required files?

•   Cause: They were not added to the required groups.

•   Solution: Create new users from a template that includes required groups.

•   Why was file server response time brought to a crawl?

•   Cause: A disk failed in a RAID 5 array so data was rebuilt on demand (Figure 7-4).

Figure 7-4  Three 4.88GB failed disks in a Windows Server software RAID 5 array

•   Solution: Ensure that hot spare disks are always available in the RAID array so that data can be rebuilt on disk and served quickly to users.

Document the Solution

Throughout the troubleshooting process, your structured approach will eventually reveal a root cause and related remedies to prevent future occurrences. You need to document the result as well as the steps taken along the way.

Many organizations use help desk ticketing software that integrates searchable knowledge functionality. When tickets are closed because solutions were found, this information is stored with metadata in a database that can be quickly searched in the future to avoid having to go through the entire troubleshooting process again if the same problem occurs. As a result, in some cases, IT configurations change, business processes are improved, and security controls are further hardened.

Hardware Problems and Solutions

These days, when hardware is properly maintained, it is pretty resilient to problems. Proper maintenance includes applying firmware updates when they are available. There’s also the issue of overheating due to insufficient airflow or failed fans, which greatly reduces the life expectancy of equipment and can cause erratic behavior.

NOTE   Most servers and related equipment have hardware sensors that detect environmental conditions such as temperature and can predict imminent failures. You may need to install software for this data to be available.

Table 7-1 lists common hardware problems and solutions. Sometimes the problem is server add-on hardware such as expansion cards (including those for blade enclosure backplanes) that are not seated properly in their slots, or onboard components integrated with the motherboard. In other cases, some hardware components may simply be incompatible with others; refer to documentation for more information. For Windows servers, check the Hardware Compatibility List (HCL).

Table 7-1  Common Hardware Issues and Solutions

Server+ technicians can be prepared by using a crash cart, which is a collection of tools and replaceable components used when troubleshooting servers. You may want to keep the following hardware and software tools handy when troubleshooting server and network hardware issues:

•   Multimeter to test power supplies

•   Hardware diagnostic tools for memory (seen in Figure 7-5), RAID controllers, disks, motherboards, and expansion cards

Figure 7-5  Windows Server built-in memory tester

•   Can of compressed air for removing dust

•   Antistatic wrist straps and ESD mats

•   Tool for testing bad RAM chips

Software Problems and Solutions

More often than not, you’ll be troubleshooting software issues instead of hardware issues. Other than the OS, application software runs in an environment that could be hosting literally millions of other software components; no wonder we spend a lot of troubleshooting time here!

Again, don’t forget to check the obvious. For example, a mobile phone user may unknowingly mute a phone microphone during a conversation and assume there is a transmission or phone problem. This specific issue is called discontinuous transmission (DTX), and simple issues like this are easily avoided with user training. Many organizations expect users to learn how to use new hardware and software solutions by themselves, without having proper training, but this is not a place to cut corners!

Table 7-2 lists commons software problems, causes, and solutions.

Table 7-2  Common Software Issues and Solutions

As a prepared CompTIA Server+ technician, you will have software utilities available at all times to resolve software issues quickly. Some restrictions, such as installing or running applications, can be related to UAC configuration, as shown in Figure 7-6.

Figure 7-6  User Account Control settings on Windows Server

Remember to check related logs for clues. For instance, if a DNS server doesn’t seem to be responding to any DNS queries from all clients, yet it’s up and running on the network, check the DNS server and client logs.

You can monitor resource use in Windows using a variety of tools:

•   Task Manager

•   Resource Monitor

•   Performance Monitor

•   Data Collector Sets

The Windows Resource Monitor (Figure 7-7) gives you further insight as to which processes are consuming the most disk I/O time, often referred to as input/output operations per second (IOPS); the other tools do not provide this detail.

Figure 7-7  Viewing disk I/O statistics in Resource Monitor

Data Collector Sets (DCSs) are similar to Performance Monitor in that you can add metrics that you want to monitor. DCSs differ from Performance Monitor in that you can control when to start and stop collecting this data, and you can configure alert notifications when certain thresholds have been exceeded. For example, if CPU utilization goes beyond 80 percent for a period of time, administrators can be notified in a variety of ways (Figure 7-8).

Figure 7-8  An alert DCS based on CPU usage

Linux systems can be started in single user mode (run level 1), where only a minimal set of services are running. The exact process varies among different versions of Linux distributions, but it involves interrupting the boot process or modifying a boot startup file. This can sometimes enable booting and troubleshooting where otherwise the machine might not even boot. UNIX and Linux environments provide various tools to troubleshoot software issues:

•   top  Lists top processes consuming resources

•   ps  Lists running processes

•   kill  Terminates processes

•   df  Shows disk free space

Windows environments have built-in tools for mapping drives, such as those that run within the GUI, command line tools such as net use (Figure 7-9), or the new-psdrive PowerShell cmdlet. You can also use the GUI to view disk, file, and folder properties by right-clicking and choosing Properties.

Figure 7-9  Mapping a drive letter in Windows with net use

Using PowerShell, the get-volume cmdlet shows file system health status as well as size statistics (Figure 7-10).

Figure 7-10  View disk volume information using get-volume

Storage Problems and Solutions

Always remember to check the obvious—for example, loose or faulty power or data cables for disk devices can cause the drive to be unavailable or available intermittently, and we want to maximize uptime. Some disk I/O buses, such as some SCSI variants, required both ends of the bus to be terminated. Newer SCSI adapters and devices are self-terminated, whereas older equipment requires a physical terminating device.

Storage media sometimes has storage areas that do not reliably store data; disk-
scanning tools will mark these areas as “bad sectors” or “sector block errors” to prevent the server OS from attempting future disk writes to these locations. If the entire disk partition (or volume, if it spans multiple disks) is corrupt, or if users do not have the correct permissions, they may receive a “cannot access logical drive” message. The same is true for servers attempting to access network storage.

Occasionally, software issues will appear to be disk-subsystem issues. Consider, for example, what happens when a power failure occurs in the midst of applying server OS patches that modify the boot sector. Chances are the boot sector will be corrupt and the server will no longer boot, which, in Linux, can result in a “kernel panic.” Luckily, modern server OS installation media often provides a repair option (Windows) or a boot Rescue Mode (Red Hat Enterprise Linux) to deal with such situations.

A failing CMOS battery can cause the server to forget its hardware configuration, including the date and time. This eventual time skew can prevent network services from talking to this server, and this can also be the source of disk boot configuration errors. Some clues regarding drive failures are obvious—hearing a light metal scraping sound as a hard disk fails or noticing the odor of electrical components burning when a circuit board is fried. Table 7-3 lists common storage problems, probable causes, and possible solutions.

Table 7-3  Common Storage Issues and Solutions

Windows Tools

You can manage and troubleshoot disks on Windows servers in a number of ways. In some cases, you may need to wipe and repartition a problematic disk—just make sure you’ve made a backup of the disk contents beforehand.

Command line tools include the following:

•   Diskpart.exe

•   Defrag.exe

•   PowerShell cmdlets

NOTE   Newer Windows OSs (such as Windows 10 and Windows Server 2019) no longer include the old fdisk command line utility; it has been replaced with diskpart.exe.

At the GUI level, you can use tools such as these:

•   Disk Management

•   Server Manager

•   Disk Defragmenter

•   Disk Cleanup

•   Error Checking

The following set of diskpart commands wipe (clean) the third disk in a machine and then convert the disk to a GUID Partition Table (GPT), which enables larger capacity partitions as well as a larger number of partitions than a master boot record (MBR). (See Chapter 4.) A 50GB primary partition is created, formatted as NTFS, and assigned drive letter E:\.

Using Microsoft PowerShell, you could initialize, partition, and format a disk, as shown in the following example:

PowerShell also includes cmdlets for troubleshooting file system issues:

Repair-Volume -DriveLetter E –OfflineScanAndFix

Linux Tools

Like Windows, some UNIX and Linux variants provide a bootable rescue mode to troubleshoot disk boot problems, often from OS installation media. From rescue mode, or in some cases, within the OS itself, you can use tools to manage and troubleshoot at the command line, including the following:

•   df  Shows disk free space

•   fsck  Checks file systems for corruption

•   xfs_repair  Checks for and repairs an XFS file system

•   iostat  Shows disk I/O statistics for storage devices

•   lsof  Lists open files and provides further details

•   mdadm  Linux software RAID array management

For example, to repair an unmounted XFS file system on /dev/sdc1, as shown in Figure 7-11, you would use this command:

Figure 7-11  Repairing an XFS file system using xfs_repair in Linux

xfs_repair /dev/sdc1

Sometimes a lack of free disk space can cause many, often performance-related, problems. Monitoring disk capacity is crucial. The Linux disk free (df) command (Figure 7-12) has a -h (human readable) switch to show file systems and their disk space usage statistics in terms of megabytes, gigabytes, and so on, instead of in units of 1KB blocks:

Figure 7-12  Viewing disk free space in Linux using the df command

df -h

To determine which Linux disk device has the most I/O activity, use the iostat command, as shown in Figure 7-13.

Figure 7-13  Viewing disk I/O statistics using the iostat Linux command

Network Problems and Solutions

Network problems can be hardware related, software related, or both. For example, physical network cables can sometimes have problems. A time-domain reflectometer (TDR) can be used to measure the continuity of electronic signals through circuit boards and the wires within a network cable to identify faults.

EXAM TIP   Don’t confuse TDRs with tone and probe generators on the exam or on the job. TDRs are used to identify where cable faults exist. Tone and probe generators are used to identify specific cables in large cable bunches by sending a tone through wires in a wall jack and identifying that signal at the other end of the cable in a wiring closet.

Optical time-domain reflectometers (OTDRs) result in traces that are used to show where fiber-optic cables are terminated and can show locations of cable breaks. OTDRs are expensive devices that require expertise to use and to interpret results.

Many network problems stem from incorrect software protocol configuration. IPv4 and IPv6 addresses must fall on the correct subnet to function properly. The default gateway, or router, is used to send traffic outside of the LAN to other local and remote subnets; it must be reachable on the LAN.

EXAM TIP   You may see at least one network architecture diagram-based question testing your knowledge of valid IP addresses, subnet masks, and which router interface your default gateway configuration should point to.

Table 7-4 outlines the reasons for common network issues and potential solutions.

Table 7-4  Common Network Issues and Solutions

When destination hosts on different networks are unreachable, the IP address, subnet mask, and default gateway must be checked to ensure that their values are correct. Incorrect routing information will result in “destination host unreachable” messages. If IP settings are correct, the Windows tracert or Linux traceroute command can be used to determine how far down the line (through routers) transmissions are getting before encountering problems. This is more useful than the ping command, which would simply report that the host is unreachable. (Note that Windows machines use the ping -6 command to use IPv6, such as when pinging a hostname; Linux systems uses the ping6 command.)

EXAM TIP   The tracert command uses ICMP as its transport mechanism. This command will not be a useful troubleshooting tool if host or network firewalls block ICMP traffic. Carefully read exam questions that mention this issue to avoid choosing the incorrect answer.

IPv6 troubleshooting is not that different from troubleshooting IP4. Similar to how the IPv4 subnet mask is compared to the IPv4 address, devices with the same IPv6 subnet prefix are considered to be on the same network. On a Windows server, ipconfig shows both IPv4 and IPv6 information.

The Windows route command (ip route show in Linux) can be used to display or modify routing table entries on a Windows server. For example, to display routes, you would use route print, as shown in Figure 7-14. Take note that the 0.0.0.0 route is the default route; notice the IP address of the default gateway on the same line.

Figure 7-14  Output from the Windows route print command

To ensure that network services are listening on a specific TCP or UDP port, use the Windows netstat command. For example, if an HTTP web server is not running and therefore not listening on TCP port 80, clients will be unable to connect to the web server.

Name Resolution Issues

If names are resolving to unexpected IP addresses, it means there are probably entries in the local HOSTS files on the system. The HOSTS file entries are placed into the client DNS cache in memory, and this cache is checked before DNS servers for name resolution.

Recent answers to DNS queries are also cached in the local client DNS memory cache and have a time-to-live (TTL) value that determines how long the entry remains cached. The Windows ipconfig command includes a /flushdns parameter that clears out the client DNS cache; use this when the DNS records have changed recently.

For further DNS troubleshooting, including solving “unknown host” name resolution errors, use the nslookup command. After typing nslookup and pressing ENTER, you will be in interactive mode. You can use the server directive to connect to a different DNS server. The set type= command changes the type of DNS resource record you want to test, as shown in Figure 7-15.

Figure 7-15  Using nslookup to view mail server information through MX records

Security Problems and Solutions

Plenty of problems arise from security compromises, from loss of critical business data, to reputation loss and potential lawsuits, and the list goes on and on. Many (not all) security problems are preventable, however, and this section will discuss how to troubleshoot security problems and how to prevent them from recurring.

Malware Troubleshooting

In addition to malware notifications, symptoms of malware infection include the following:

•   Excessive and prolonged hardware resource use

•   Inability to reach network resources

•   Web browser home page is changed and is not editable

•   Web browser opens pages user didn’t navigate to

•   Rogue processes or services (mystery processes) running with improper privilege escalation

•   Missing log entries (cleared by the attacker)

•   Encrypted files with a message demanding payment

•   Abnormal listening ports on the server, which could indicate a backdoor created with tools such as netcat (nc)

User awareness and training is the number one defense against most security threats. Chapter 6 discussed social engineering and user awareness regarding network malware attacks.

When infections are detected, the server or subnet must be isolated immediately; this can be done manually or automated through your antimalware solution. You can specify a script that runs on detection. The script may look at the subnet address and disable routing to and from the subnet, or it may disable the switch port that links that subnet to the rest of the network. Many malware infections sometimes attempt to connect to a command and control (C&C) server outside of the local network, in some cases using HTTP or DNS packets in an attempt to make the traffic blend in with normal traffic. Configure your network IDS and IPS solutions accordingly.

NOTE   Servers should never be used as desktop computers. Tasks such as checking e-mail, reading the news, or downloading drivers should never be allowed directly on a server.

Malware Removal

The removal of malware can be done in many ways:

•   Vendor malware removal tool

•   Windows system restore point

•   Client OS only, not Windows Server OS

•   Revert to previous configuration, not data

•   Server reinstall or reimage

•   Ensure that you have a working backup

•   Ensure that the image being restored matches the available physical or virtual server hardware configuration

•   As a last resort, manually restore the OS

•   Boot through alternative means to remove the infection

•   Windows safe mode

•   USB boot to run removal tool

•   PXE boot to run removal tool

You should use more than one antimalware product to ensure that remnants of the infection do not remain; however, do not run multiple antimalware products at the same time, because some infections could be missed because of conflicts. Keep in mind that even if multiple scans do not detect an infection, this doesn’t mean the system is not infected; a zero-day attack may be the culprit, for example, which may not be detected by a malware scanner.

Antimalware heuristic analysis is useful in detecting previously unknown malware by analyzing suspicious behavior, similarly to how IDS and IPS systems watch for abnormal host activities or network traffic. The downside is false positives, the reporting of problems when they do not exist.

Too Few Permissions

Chapter 6 discussed file system permissions for Windows and Linux systems. Normally, users are added to groups, and groups are added to ACLs and either granted or denied permissions.

Permissions in Windows

On Windows servers, combining share and NTFS permissions results in the most restrictive permissions being applied, and this is a big part of troubleshooting file system issues in Windows environments. In the GUI, you can view the properties of a file or folder to see the effective permissions for a given user or group if a user is unable to open a file.

Too few permissions can also mean applications won’t launch. Windows systems may need UAC settings loosened up to enable apps to run. Some apps require administrative privileges not only to install but also to run—it depends on the app and where it reads and writes to and from in the file system and registry. On a Windows server, you can hold the SHIFT key while right-clicking a program file such as an .exe file to see the “Run as administrator” or “Run as different user” options.

For Windows machines, Local Group Policy executes before Active Directory Site, Domain, and OU Group Policy settings. Group Policy is often used to harden Windows clients and servers, but sometimes it may be a little too restrictive, and it’s important that you know how to view effective Group Policy Objects (GPOs) for a server to troubleshoot this type of issue. While the gpudate command forces a Group Policy update, gpresult /r shows the resultant set of policy, listing GPOs that are applied to the machine where the command was run. Figure 7-16 shows the output from gpresult /r.

Figure 7-16  Output from the Windows gpresult /r command

Security filtering enables Group Policy administrators to ensure that only specific users or computers get Group Policy settings. This can be done by specifying individual users, computers, or groups, or by using Windows Management Instrumentation (WMI) filters. WMI filters use the WMI Query Language (WQL), as shown in the following example, where Microsoft Hyper-V and VMware virtual machines are being selected:

EXAM TIP   Exam questions may imply that central configuration changes (Group Policy) have been made and that they have affected some or all users or computers. Remember that “some” computers or users could be very specific, as shown in the WQL example. WQL can query any hardware or software attribute related to users or computers.

Privileges in Linux

Linux administrators can use the sudo command prefix in front of a command that requires elevated privilege—of course, sudo has to be configured in the first place to enable this. The following command enables a sudo-authorized regular user to set the password for bjones using sudo:

sudo passwd bjones

Another consideration in Linux is the SetUID special bit, which enables an executed script or binary to run not as the invoker, but as the file owner (which could be root). This warrants very careful attention, but it can solve the problem of a regular user not being able to run a script or program. The following example adds the SetUID bit to a file called /backupscript.sh. If someone can execute the script, it will run with the permissions of whoever the file owner is (find this out by using ls -l).

chmod u+s /file.txt

Restoring File System ACLs

You can save file system ACLs and restore them if you run into trouble later. The icacls command works well for this on Windows servers; getfacl and setfacl work well in Linux.

Windows ACLs  In this example, the first command displays ACL entries for user DLachance in and under E:\Projects. The second command saves the ACL entries to a file, and the third command restores ACLs to the file system from the Project_ACLs_Server1 file.

If users were once able to open files and now cannot, ACLs may have been changed, so you can use icacls in this case.

Linux ACLs  The Linux getfacl and setfacl commands work well for saving and restoring ACLs. In the following examples, the first command recursively gets file system ACLs from /budgets and saves to a file called /budget_acls; the second command restores ACLs from the saved file.

Too Many Permissions

When someone needs permissions quickly to do something in Windows, it’s tempting to add the user to the Administrators (local) or Domain Admins (Active Directory) group to expedite the request, but this is blatant disregard for the principle of least privilege.

Users must be granted only those permissions required to complete a job task and nothing more. Of course, this prerequisite may take a bit of research and testing on your part, but it’s worth the up-front time investment to grant permissions correctly. A security audit can reveal this problem, or you can proactively check into it, perhaps by using commands such as icacls or getfacl, or by using a third-party security auditing tool.

Too Much Running

Modern server OSs are bare-bones, meaning they don’t have many extra software components installed by default, so you have to install them. This is a good thing, because having too many services running simultaneously on a single server can negatively affect performance.

Port-scanning tools (such as the one shown in Figure 7-17) should be used periodically as a proactive measure to determine which ports are open on hosts. This gives you a picture of which network services are running, which is related to which firewall ports should be open on both host-based and network-based firewalls.

Figure 7-17  Results of a port scan against a Linux host

Of course, having many services running also increases the attack surface and increases the amount of time required to patch the server—so keep it minimal when possible!

Confidentiality and Integrity

Encryption provides confidentiality. A cipher is a cryptographic algorithm that is used to scramble, or encrypt, and decrypt data. Use of an incorrect cipher can cause problems. Some hardware appliances and software configurations require the use of certain ciphers. For example, server file encryption software may be able to decrypt AES 128-bit files but not AES 256-bit messages, so cipher strength can be a problem.

The same type of situation could occur at the network level. You may be using an older web browser that does not support the encryption required by the web server. Yet another web browser problem may be PKI certificate trust: When connecting to an HTTP web server, your browser checks the signer of the server’s PKI certificate. If the web browser does not trust the signer, it does not trust the PKI certificate used by the web site. This is solved by adding a new trusted certificate signer to the web browser device.

Integrity uses a hashing algorithm such as SHA-256 to ensure the trustworthiness of data, in that it is authentic and has not been tampered with. Authentication can occur at the network packet level or at the file level. You can use packet sniffing (capturing) tools such as Wireshark to analyze packets on the network as well as bad packet checksums. Packet checksums are used to ensure that what is received is what was sent, and, if not, a retransmission may occur (which depends on the protocol being used). Packet sniffing can also reveal the use of insecure tools such as Telnet (Figure 7-18), which transmits data in clear text. The use of insecure tools can introduce malware or could serve as an attack vector for malicious uses—more trouble that we don’t need!

Figure 7-18  Viewing Telnet captured network traffic in Wireshark

Files can be hashed using various tools. A file hash is a unique value that represents the state of a file. If anything about the file changes, when we generate a new hash, it won’t match the old one; this tells us that something has changed.

Microsoft PowerShell supports file hashing using the get-filehash cmdlet:

get-filehash .\Project1.txt

The Linux sha256sum command, shown in Figure 7-19, can be used to generate and verify file hashes. Notice that the first hash of samplefile1.txt (beginning with 0356) differs from the second hash (beginning with f9b5), because a change was made to samplefile1.txt (the text “More sample data” was appended to samplefile1.txt).

Figure 7-19  Hashing files in Linux using sha256sum

Performance Optimization

Performance optimization applies to hardware, software, and specific implementation settings. It’s important that you always monitor your environment for any changes in performance so that you can take action before you end up troubleshooting major issues. Plenty of enterprise-class network and server monitoring tools are available, such as Spiceworks and Microsoft System Center Operations Manager, to name a few.

The Windows Performance Monitor tool (Figure 7-20) is built into the Windows OS. It enables you to add items to monitor, such as network components, specific software components, hardware items such as CPUs and physical memory, and more. You can also use Performance Monitor to reach out over the network to monitor servers.

Figure 7-20  Windows Performance Monitor

Linux administrators commonly use tools such as ps, top, and iostat for performance monitoring.

Hardware Optimization

Naturally, getting the fastest and most reliable hardware is always desired. More CPU cores and more RAM (especially for hypervisor servers) all make a difference in performance.

Since disk I/O often tends to be the performance bottleneck, it warrants our attention when it comes to optimizing performance. As discussed in Chapter 3, solid-state drives (SSDs) perform better than magnetic hard disk drives (HDDs), and you can configure them both in storage tiers so that frequently accessed data is stored on the faster SSDs.

Whether server storage is local or accessed via a storage area network (SAN), hardware RAID levels designed for performance (disk striping, or RAID 0, for example) should be used. In the cloud, selecting the number of virtual CPUs, amount of RAM, and disk type for a virtual server is referred to as sizing.

Software Optimization

Having fast hardware is important, but so is the software configuration that uses it. For example, adding more RAM to a hypervisor server makes sense, because it will host multiple virtual machines, but at the software level, each virtual machine may be configured with dynamic memory. This means virtual machines currently needing RAM can “borrow” it from those virtual machines that do not currently need it. Allocating too much RAM statically to one virtual machine can starve others from memory.

Less is more. Keep your server OS clean, and install only the components that are needed. Not only will this keep your server running quickly, but it reduces the attack surface, decreases patching time, and reduces the overall amount of troubleshooting. The more stuff you have installed and running, the greater the likelihood of something going wrong.

Network Optimization

In addition to getting faster network equipment (switches, routers, NICs) or Internet connections, you can improve network performance with what you already have.

VLANs can be configured within network switches to group machines that communicate often with one another into smaller networks. Breaking large networks into smaller ones makes network transmissions much more efficient and essentially speeds up the network.

Servers normally have multiple NICs. You might consider configuring NIC teaming to group NICs together for better network throughput into and out of the server. Bear in mind that network switch ports where the server NICs are plugged in must be configured so that inbound server traffic can take advantage of NIC teaming.

Network load balancing (NLB) distributes incoming traffic for network services such as a web site to multiple back-end servers running the same service and holding the same content. For example, you might have four back-end web servers configured the same that replicate web site content to one another. The public IP address of the NLB is what DNS FQDNs would resolve to, not the back-end server IPs. Load balancers can improve the performance of an on-premises application or a cloud application.

One great thing about this in the public cloud is elastically scaling the number of back-end servers as needed behind the NLB, such as in response to increased demand. This is called horizontal scaling. The end result is that the network service responds quickly.

Notice in Figure 7-21 that load balancers listen on a specific public port—in this case, TCP port 80 for an HTTP application—and that the configuration specifies an internal port number that could be different. Also notice in the figure that step 5 of the wizard enables you to add multiple EC2 virtual machine instances (the back-end servers).

Figure 7-21  Creating an elastic load balancer in the Amazon Web Services cloud

You should periodically capture network traffic and examine the capture results to ensure that only required network protocols are in use.

Hands-on Exercises

Exercise 7-1: Explore Windows Performance Monitoring Tools

1.   Ensure that you are logged into Srv2019-1 with the Domain Administrator account (Fakedomain\Administrator) with a password of Pa$$w0rd172hfX.

2.   From the Start menu, enter perf and then click Performance Monitor.

3.   On the left, expand Monitoring Tools if it’s not already expanded, and then click Performance Monitor. The %Processor Time counter is automatically shown on the graph to the right.

4.   Click the green plus sign at the top of the screen to add monitored items.

5.   Scroll within the alphabetized list, expand Physical Disk, and choose Avg. Disk Queue Length. At the bottom left, choose C: (it may be listed with a number, such as 2 C:) and click Add. Then click OK. The Avg. Disk Queue Length counter is added to the chart (view the counter underneath the chart). Disk commands that cannot be serviced immediately due to a busy disk are queued up, which is normal in most environments. The specific value that should be of concern here will vary in different environments.

6.   Start Windows Explorer. Navigate to C:\. Right-click C:\Program Files, choose Copy, and then press CTRL-V to paste. This will generate disk I/O activity.

7.   Switch back to Performance Monitor and notice the graph spikes. Hover your mouse pointer over the highest graph spike to display the specific metric that the line represents.

8.   Using Windows Explorer, delete the copy of Program Files on C:\.

9.   Switch back to Performance Monitor. On the left, expand Data Collector Sets. Right-click User Defined and choose New | Data Collector Set. Enter Notify of CPU spikes for the name.

10.   Choose Create Manually (Advanced).

11.   Click Next and select Performance Counter Alert. Click Next.

12.   Click Add. Scroll down to the Processor category and expand it. Choose %Processor Time, click Add, and then click OK.

13.   At the bottom, specify Above 90 for the Limit value and click Next.

14.   Choose Open Properties For This Data Collector Set and click Finish. In the Notify Of CPU Spikes Properties dialog box, click the Schedule tab, click Add, and set the beginning date to today’s date. Click OK twice.

15.   Double-click Notify Of CPU Spikes in the list. Double-click DataCollector01. Set the sampling interval to every 15 minutes.

16.   Open the Alert Action tab and check the Log An Entry in the Application Event Log option. Then click OK.

Exercise 7-2: Explore Linux Performance Monitoring Tools

1.   Ensure that you are logged into Ubuntu-1 as uone with a password of Pa$$w0rd172hfX. Press ENTER after each command you type in the following steps.

2.   Enter df -h and notice free disk space on disk devices under the Avail column as well as the Use% column.

3.   Enter ps -aux | grep sshd to view SSH daemon process information only. The grep command is a line-filtering command. Notice the PID (column 2) and the %CPU utilization (column 3). If you see “Zombie” processes, these are processes that have finished executing but are waiting for the parent process to complete.

4.   Enter top. Notice that the display changes every few seconds.

5.   Press S and then enter .5 to increase the update frequency to every half-second. Press ENTER.

6.   Press Q to exit.

Exercise 7-3: Use Microsoft PowerShell to Retrieve Event Log Information

1.   Switch to Srv2019-1.

2.   Start PowerShell.

3.   Enter get-eventlog system. Notice the long list of event log entries. You can interrupt this if it takes too long by pressing CTRL-C.

4.   Enter get-eventlog system -newest 5.

5.   Enter get-eventlog system -entrytype warning | more. Warning log entries are displayed. Press CTRL-C.

6.   Enter get-eventlog security -newest 10 -computername Srv2019-1. Remote security log entries are displayed from Srv2019-1.

NOTE   The -computername parameter is used here for demonstration purposes only. It is not needed because we are already at Srv2019-1 issuing the command. You can specify multiple computer names in a comma-separated list.

Exercise 7-4: View Linux Log File Entries

1.   Switch to Ubuntu-1.

2.   Enter dmesg | grep scsi to view SCSI disk device startup messages.

3.   Enter cat /var/log/syslog | more to review the Linux system log file one screen at a time. Press the SPACEBAR to advance one line at a time. Press Q to quit.

NOTE   To view real-time log file updates in Linux, use tail –f. For example, tail -f /var/log/syslog. Press CTRL-C to exit the viewing.

Chapter Review

Troubleshooting and performance optimization are linked. Poor performance indicates that you should troubleshoot the case and remedy the issue. Follow a structured approach to solve problems as quickly and efficiently as possible.

Troubleshooting Methodology

Follow the standard troubleshooting steps:

1.   Identify the problem.

•   Determine the scope.

•   Question stakeholders.

•   Reproduce the problem.

•   Consult log files and documentation.

2.   Establish a theory of probable cause.

•   Check the obvious.

3.   Test the theory.

•   Use a test environment.

4.   Establish a plan of action.

•   Notify stakeholders.

•   Establish an implementation timeline.

5.   Implement a solution or escalate.

•   Change one thing at a time.

•   Revert ineffective changes.

6.   Verify functionality.

•   Test thoroughly.

•   Satisfy the end user.

7.   Perform a root cause analysis.

•   Determine the source of symptoms.

8.   Document the solution.

•   Keep a record during all troubleshooting phases.

Hardware Problems and Solutions

Hardware problems are quickly fixed with proper documentation (OEM and implementation), as well as tools such as multimeters to test power and diagnostic tools to test memory and RAID controller health and configurations. Other hardware issues to watch out for include the following:

•   Apply firmware patches.

•   Ensure that firmware in use is compatible with other hardware components.

•   Ensure that proper HVAC is in place.

•   Determine any hardware incompatibilities.

•   Look for component failures (sometimes identified during POST).

•   Look for boot failures.

•   Check power issues.

Software Problems and Solutions

Software troubleshooting includes the operating system, drivers, and applications. Resolving software issues includes taking actions such as these:

•   Apply software patches.

•   Operating system

•   Drivers

•   Applications

•   Reset the user password.

•   Delete corrupt user profiles.

•   Ensure that user permissions are set correctly for user and service accounts; restart services if making configuration changes.

•   Run antimalware scans.

•   Use monitoring tools to identify memory leaks or runaway processes.

•   Boot into safe mode, repair mode, or rescue mode.

•   Ensure that dependent services are running.

•   Restart problematic services.

Storage Problems and Solutions

Physical storage device and cable issues can sometimes be the source of problems. Hot spare disks in disk arrays provide a quick way to resolve failed disk issues. Other items include the following:

•   Disk I/O bus termination

•   Failed disk adapters

•   Failed disks

•   Failed network path to network storage

•   Insufficient disk space

•   Insufficient user permissions to access storage

•   File system corruption

•   Slow file access

•   Incorrect use of RAID level

Network Problems and Solutions

Physical network components such as NICs, switches, routers, and wireless access points can fail. Firmware and driver updates should be applied for optimal stability and functionality. TDRs and OTDRs can be used to ensure copper-based and fiber-optic cable continuity. Other network issues include the following:

•   Incorrect IP address, subnet mask

•   Incorrect default gateway, DNS server

•   DHCP/DNS server unreachable

•   Firewalls (network ACLs) blocking legitimate traffic

•   Incorrect VLAN membership

•   Mismatched NIC speed settings

Security Problems and Solutions

Documentation regarding the implementation of security controls reduces time spent troubleshooting. Other security issues include the following:

•   Malware infections

•   Inadequate authentication as required by server

•   Untrusted or expired PKI certificate

•   Insufficient permissions to access a network resource

•   Too many permissions granted beyond what is required

•   Incorrectly assigned share, NTFS, or Linux file system permissions

•   Group Policy settings enforcing too little or too much security

•   Linux users not using the sudo command prefix to run elevated commands

•   Unnecessary installed software

•   Unneeded running services

•   Incorrectly configured network firewall ACLs

•   Mismatched cryptography ciphers

•   Inability to decrypt transmissions or files

Performance Optimization

Performance optimization can result from replaced components, changed configurations, and ongoing monitoring of resource use.

Windows monitoring tools include the following:

•   Task Manager

•   Resource Monitor

•   Performance Monitor

•   Reliability history

•   Log files

Linux monitoring tools include these:

•   ps

•   top

•   iostat

•   df

Network optimizations include NIC teaming, VLAN traffic isolation, and network load balancing.

Questions

1.   Which troubleshooting step involves questioning stakeholders?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Establish a plan of action.

2.   Which troubleshooting step involves reproducing the problem?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Establish a plan of action.

3.   Which troubleshooting step involves making only a single change at a time?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Implement the solution.

4.   Which troubleshooting item focuses on how and why a problem occurred?

A.   Test the theory.

B.   Identify the problem.

C.   Establish a plan of action.

D.   Perform root cause analysis.

5.   Users complain that a database server has slowed down over the last hour despite the fact that no more users have connected. You run an antimalware scan, which comes up clean. The amount of network traffic has not changed. You reboot the server and the problem still persists. What is the most likely cause of the problem?

A.   Malware infection

B.   Boot sector corruption

C.   DDoS attack

D.   Overheating

6.   One of your servers, FS1, is configured with a RAID 5 array. The server has 2TB of free disk space and overall CPU and memory utilization is hovering at 40 percent. Over the last hour, file reads from FS1 have been very slow. What is the most likely cause of the performance issue?

A.   Insufficient disk space

B.   File encryption

C.   Runaway process

D.   Failed RAID 5 disk

7.   Which tool should be used to test server power supplies?

A.   Multimeter

B.   TDR

C.   OTDR

D.   Compressed air

8.   A user station statically configured with IPv4 cannot download Group Policy settings; the error message states that a domain controller could not be found. The station can communicate with other local and remote hosts. Prior to the change from DHCP to static configuration, Group Policy worked. What is the most likely cause of the problem?

A.   Incorrect subnet mask

B.   Incorrect default gateway

C.   Incorrect DNS server

D.   Incorrect IP address

9.   You are an Active Directory domain administrator. You attempt to install a server application on a domain-joined server. When you attempt to run the installer, nothing happens. What is the likely cause of the problem?

A.   Lack of administrative privileges

B.   Server needs to be patched

C.   User Account Control

D.   Insufficient disk space

10.   A shared network folder contains Linux shell scripts. The folder permissions are set as shown in the following illustration. Technicians in the it_admins group are unable to run scripts from the /scripts folder. What should you do?

A.   Grant the it_admins group the execute permission.

B.   Set the UID bit on scripts so that they run as the owner.

C.   Grant the it_admins group the write permission.

D.   Tell technicians to use sudo.

11.   A newly installed NIC driver on your Windows server has rendered the system unstable. What should you do?

A.   Roll back the driver.

B.   Reimage the server.

C.   Revert the server using a system restore point.

D.   Remove the NIC.

12.   Which Linux command can be used to terminate a rogue process?

A.   terminate

B.   remove

C.   taskkill

D.   kill

13.   Which Linux tool should you use to view disk device read and write statistics?

A.   df

B.   fdisk

C.   iostat

D.   diskstat

14.   Which Linux tool should you use to troubleshoot CPU resource utilization in real-time?

A.   iostat

B.   kill

C.   ps

D.   top

15.   Which PowerShell cmdlet can fix corrupt file systems?

A.   Diskpart

B.   Fdisk

C.   Fix-volume

D.   Repair-volume

16.   You have manually configured a route to a remote network on your Windows server. Which command will show this newly added route?

A.   ipconfig

B.   ifconfig

C.   ip route show

D.   route print

17.   Your server IP settings are configured as shown in the following illustration. Which setting is incorrect?

A.   The IPv6 address prefix

B.   The IP address

C.   The subnet mask

D.   The default gateway

18.   Which Linux command reports each router crossed when communicating with a remote host?

A.   traceroute

B.   tracert

C.   routetrace

D.   routetr

19.   What is one possible drawback of heuristic host and network analysis?

A.   False negatives

B.   True negatives

C.   True positives

D.   False positives

20.   Which Windows command can be used to view and troubleshoot file system ACLs?

A.   icacls

B.   getfacl

C.   setfacl

D.   cipher

Questions and Answers

1.   Which troubleshooting step involves questioning stakeholders?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Establish a plan of action.

A. Questioning stakeholders is a part of problem identification. B, C, and D are incorrect. Stakeholder questioning falls under problem identification and not the other troubleshooting steps.

2.   Which troubleshooting step involves reproducing the problem?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Establish a plan of action.

A. Reproducing the problem relates to problem identification. B, C, and D are incorrect. Reproducing problems is part of problem identification and not the other troubleshooting steps.

3.   Which troubleshooting step involves making only a single change at a time?

A.   Identify the problem.

B.   Establish a theory of probable cause.

C.   Test the theory.

D.   Implement the solution.

D. Changing one item at a time is part of implementing the solution. A, B, and C are incorrect. These troubleshooting steps do not include changing one item at a time.

4.   Which troubleshooting item focuses on how and why a problem occurred?

A.   Test the theory.

B.   Identify the problem.

C.   Establish a plan of action.

D.   Perform root cause analysis.

D. Root cause analysis deals not with symptoms of problems, but with what caused the symptoms. This can be used to prevent similar future incidents. A, B, and C are incorrect. These troubleshooting steps are not as specific as a root cause analysis.

5.   Users complain that a database server has slowed down over the last hour despite the fact that no more users have connected. You run an antimalware scan, which comes up clean. The amount of network traffic has not changed. You reboot the server and the problem still persists. What is the most likely cause of the problem?

A.   Malware infection

B.   Boot sector corruption

C.   DDoS attack

D.   Overheating

D. Overheating can cause CPU cores to throttle themselves (slow down) to reduce heat generated. A, B, and C are incorrect. The question states that a malware scan was performed and there was no infection. Rebooting the server means there are no boot sector corruption issues. A DDoS attack would increase network traffic.

6.   One of your servers, FS1, is configured with a RAID 5 array. The server has 2TB of free disk space and overall CPU and memory utilization is hovering at 40 percent. Over the last hour, file reads from FS1 have been very slow. What is the most likely cause of the performance issue?

A.   Insufficient disk space

B.   File encryption

C.   Runaway process

D.   Failed RAID 5 disk

D. RAID 5 can tolerate a single disk failure. When this happens, requested data is rebuilt on demand from distributed parity information on other disks in the array. A, B, and C are incorrect. There is plenty of free disk space, file encryption is not mentioned in the question, and a runaway process would most likely increase CPU or memory utilization, which is low.

7.   Which tool should be used to test server power supplies?

A.   Multimeter

B.   TDR

C.   OTDR

D.   Compressed air

A. Multimeters can be used to verify that the correct voltage is delivered from power supplies to components. B, C, and D are incorrect. TDRs and OTDRs are used to test copper and fiber cable continuity. Compressed air is used to clear away accumulated dust.

8.   A user station statically configured with IPv4 cannot download Group Policy settings; the error message states that a domain controller could not be found. The station can communicate with other local and remote hosts. Prior to the change from DHCP to static configuration, Group Policy worked. What is the most likely cause of the problem?

A.   Incorrect subnet mask

B.   Incorrect default gateway

C.   Incorrect DNS server

D.   Incorrect IP address

C. DNS queries are used to find service location records for domain controllers. Pointing to a different DNS server could mean the required service location records are not present. A, B, and D are incorrect. The subnet mask, default gateway, and IP address cannot be problematic if communication with local and remote hosts is working.

9.   You are an Active Directory domain administrator. You attempt to install a server application on a domain-joined server. When you attempt to run the installer, nothing happens. What is the likely cause of the problem?

A.   Lack of administrative privileges

B.   Server needs to be patched

C.   User Account Control

D.   Insufficient disk space

C. User Account Control is the most likely problem. Even logged-in administrators may have to right-click an installer and choose Run As Administrator. A, B, and D are incorrect. There is no lack of privileges; the user is a domain administrator. Server patching and insufficient disk space would not cause this symptom.

10.   A shared network folder contains Linux shell scripts. The folder permissions are set as shown in the following illustration. Technicians in the it_admins group are unable to run scripts from the /scripts folder. What should you do?

A.   Grant the it_admins group the execute permission.

B.   Set the UID bit on scripts so that they run as the owner.

C.   Grant the it_admins group the write permission.

D.   Tell technicians to use sudo.

A. The Linux execute permission is missing and is required to run shell scripts. B, C, and D are incorrect. The Linux UID bit runs a script as the owner, not the invoker. This level of access is not needed and violates the principle of least privilege. Write permission is not needed to run a script, and sudo is not required to run a script.

11.   A newly installed NIC driver on your Windows server has rendered the system unstable. What should you do?

A.   Roll back the driver.

B.   Reimage the server.

C.   Revert the server using a system restore point.

D.   Remove the NIC.

A. Driver rollback reverts only the change to the driver. B, C, and D are incorrect. Windows servers cannot use system restore points. Reimaging the server is overkill when only a driver was changed. Removing the NIC is unnecessary since driver rollback will solve the problem.

12.   Which Linux command can be used to terminate a rogue process?

A.   terminate

B.   remove

C.   taskkill

D.   kill

D. Given the Process Identifier (PID), the Linux kill command can terminate the process. A, B, and C are incorrect. There is no Linux terminate, remove, or taskkill command, although taskkill is a valid Windows command.

13.   Which Linux tool should you use to view disk device read and write statistics?

A.   df

B.   fdisk

C.   iostat

D.   diskstat

C. The Linux iostat command displays disk device read and write statistics. A, B, and D are incorrect. df shows disk free space, fdisk is used to work with disk partitions, and diskstat is not a valid Linux command.

14.   Which Linux tool should you use to troubleshoot CPU resource utilization in real-time?

A.   iostat

B.   kill

C.   ps

D.   top

D. The Linux top command shows a changing display of the top resource-consuming processes. The timing interval for the display can be configured. A, B, and C are incorrect. Disk space statistics result from the iostat command. Given the PID, kill terminates processes. ps lists processes and potentially their CPU utilization, but it is a static display (unchanging).

15.   Which PowerShell cmdlet can fix corrupt filesystems?

A.   Diskpart

B.   Fdisk

C.   Fix-volume

D.   Repair-volume

D. The PowerShell repair-volume cmdlet can fix file system problems when the disk volume is not mounted. A, B, and C are incorrect. Diskpart is used to work with disks and file systems, but not to fix corrupt file systems. Fdisk is no longer used in Windows, and PowerShell implies that Windows is in use. There is no cmdlet called fix-volume.

16.   You have manually configured a route to a remote network on your Windows server. Which command will show this newly added route?

A.   ipconfig

B.   ifconfig

C.   ip route show

D.   route print

D. The route print command shows Windows routing table entries. A, B, and C are incorrect. The commands ipconfig in Windows and ifconfig in Linux do not show routing table information, and ip route show is a Linux command.

17.   Your server IP settings are configured as shown in the following illustration. Which setting is incorrect?

A.   The IPv6 address prefix

B.   The IP address

C.   The subnet mask

D.   The default gateway

D. The default gateway must be on the same subnet as the device pointing to it. A, B, and C are incorrect. fe80 is a valid IPv6 link-local address prefix, and the IP address and subnet mask are correct.

18.   Which Linux command reports each router crossed when communicating with a remote host?

A.   traceroute

B.   tracert

C.   routetrace

D.   routetr

A. The Linux traceroute command shows information for each router crossed when communicating with remote hosts. B, C, and D are incorrect. The tracert command is a Windows command, and routetrace and routetr are not valid commands.

19.   What is one possible drawback of heuristic host and network analysis?

A.   False negatives

B.   True negatives

C.   True positives

D.   False positives

D. Heuristic analysis does not use signature comparisons for malware and network attacks; instead, it tracks what appears to be abnormal or suspicious activity. Occasionally false positives occur, where a problem is reported even though one does not exist. A, B, and C are incorrect. These are not drawbacks of heuristic host and network analysis.

20.   Which Windows command can be used to view and troubleshoot file system ACLs?

A.   icacls

B.   getfacl

C.   setfacl

D.   cipher

A. The Windows icacls command is designed to work with file system ACLs. B, C, and D are incorrect. getfacl and setfacl are Linux commands, and cipher is a Windows command for working with the Encrypting File System (EFS).

APPENDIX A

About the Hands-on Exercises and Lab Setup

Performing tasks hands-on is, for most people, the best way to learn and retain information. Each chapter in this book contains not only text and practice questions that will help you attain your CompTIA Server+ certification but also hands-on exercises to reinforce what was covered in each chapter.

Lab Exercise Overview

Figure A-1 shows a diagram of the three virtual machine servers that you’ll create and configure through the exercises.

Figure A-1  Virtual machine layout used in lab exercises

Microsoft Windows

The Windows Server operating system is widely used around the world in numerous industries. The lab exercises in this book are designed to familiarize you with how to configure the operating system to meet specific business needs.

Windows servers can be administered using various graphical tools either locally on the server or remotely using a remote management solution such as Remote Desktop Protocol (RDP). For many years, administrators have also managed Windows servers from the command line using batch files, Visual Basic scripts, and, more recently, PowerShell.

Command line tools provide a way for you to automate repetitive tasks by creating scripts containing the relevant commands. These scripts can even be scheduled using the Windows Task Scheduler in the Control Panel.

The CompTIA Server+ Certification SK0-005 exam will not test you on many specifics of the Windows operating system, but you will be tested on general server concepts that are reinforced by completing the lab exercises. It’s similar to a boxer doing push-ups or skipping rope; those exercises will never be used in the ring during a boxing match, but they help condition the body (and, by extension, the mind) for the real thing.

Linux

Like Windows, Linux is widely used around the world in numerous industries for a variety of network services. According to Microsoft, the Azure cloud platform contains more Linux virtual machines than Microsoft virtual machines—apparently, there is some interest in Linux.

CompTIA Server+ certification candidates should be comfortable performing basic administrative tasks in the Linux environment. Despite the fact that there are hundreds of different Linux distributions, the vast majority of concepts and command line syntax are the same for all of them.

Throughout this book, in the lab exercises, you’ll be working with Ubuntu Linux 20.04.1, mostly at the command line. Linux commands, unlike Windows commands, are case-sensitive. This is true even with some command parameters, so that –c and –C, for example, may not mean the same thing (it depends on the command).

If you install Ubuntu Linux 20.04.1 according to the instructions in the lab exercise, the labs should run smoothly.

Requirements for Hands-on Exercises

You’ll need VMware Workstation 16 Pro as well as the installation media for Windows Server 2019 and Ubuntu Linux 20.04.1 to follow along with the hands-on exercises in this book.

You can download free trials of both, so you won’t have to buy them to experiment with them. If you decide to install the server operating systems on physical systems or in a virtualization environment other than Workstation 16 Pro, the exercise steps will differ slightly from the ones in this book. For example, adding virtual hard disks in VMware takes seconds, but on a physical host, you need to acquire and install the physical disks before they can be used by the server operating system.

The lab exercises are written for Workstation 16 Pro running on a Windows 10 computer. You’ll need the appropriate access to install software on the computer, and it will have to meet hardware requirements listed in the following section.

Hardware Requirements

To facilitate the installation and configuration of the Windows and Linux operating systems, the lab exercises are written to be used on Workstation 16 Pro virtual machines. Microsoft Hyper-V, Oracle VM VirtualBox, or another virtualization system will work equally well, but if you don’t use Workstation 16 Pro, the lab instructions shown in this book will differ slightly from those you’ll need for your environment.

You can run Workstation 16 Pro on any type of machine as long as certain requirements are met. For example, if you have a laptop computer that meets the following requirements, you’re good to go! Here are the hardware requirements for your VMware host computer that will run Windows and Linux virtual machines:

•   64-bit computer

•   Hardware virtualization (Intel Virtualization Technology or AMD Virtualization)

•   At least 8GB of RAM in total

•   Enough storage space for both the Windows and Linux ISO files (approximately 7GB of disk space)

•   Enough storage space to create Windows and Linux virtual machines (approximately 80GB of disk space)

Note that these are minimum requirements; more RAM and disk space is better!

VMware Workstation 16 Pro

You can download Workstation 16 Pro from https://www.vmware.com/ca/products/workstation-pro/workstation-pro-evaluation.html, as shown in Figure A-2. You can use it for free for 30 days, but you’ll need to create an account at VMware before you can proceed with the download. If you want to follow along with the specific instructions for labs, make sure you download and install Workstation Pro for Windows.

Figure A-2  Workstation Pro download web page

Install Workstation 16 Pro

The downloaded installation provides an executable (.exe) file that you can run on your Windows computer. Make sure that you don’t have another virtualization product installed, because it could interfere with the installation or running of Workstation Pro, or the steps and messages may differ. You may also need to pause your antimalware real-time protection feature temporarily to complete the installation, including the Windows 10 built-in virus and threat protection tool.

If you’re installing the product from scratch, meaning a previous version is not installed, follow these steps:

1.   Right-click the downloaded .exe installer file and choose Run As Administrator. Depending on your Windows configuration, you may be informed that the app is not a Microsoft-verified app, but click Install anyway. On the Do You Want To Allow This App To Make Changes To Your Device? screen, click Yes.

2.   On the Welcome To The VMware Workstation Pro Setup Wizard screen, click Next.

3.   On the End-User License Agreement screen, select I Accept The Terms In The License Agreement, and then click Next. If you see a Compatible Setup dialog box because Hyper-V components are installed, select Install Windows Hypervisor Platform (WHP) Automatically and click Next.

4.   On the Custom Setup screen, accept the default settings and click Next.

5.   On the User Experience Settings page, uncheck both options and then click Next.

6.   On the Shortcuts screen, accept the default selections and click Next.

7.   On the Ready To Install VMware Workstation Pro screen, click Install.

8.   On the Completed The VMware Workstation Pro Setup Wizard screen, click Finish.

9.   Once the installation completes and you’ve closed any installation windows, go to your computer’s Start menu and start the Workstation Pro application to ensure that it launches.

10.   On the VMware Workstation 16 screen, select I Want To Try VMware Workstation 16 For 30 Days and then click Finish, and if prompted with a Windows UAC message, choose Yes.

11.   If presented with a Thank You screen, click Finish, and then close the VMware Workstation application.

12.   If you disabled antivirus real-time protection to complete the installation, remember to turn it back on.

Acquiring Windows and Linux Installation Media

Since URLs change, you may need to use your favorite search engine to find these downloads; however, URL links that are valid at the time of this writing are provided in the following sections for convenience.

Windows

Visit the Microsoft Evaluation Center at https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019, as shown in Figure A-3, to download the Windows Server 2019 installation ISO file. If you don’t already have an account, you’ll need to register before you can download the ISO file for a free 180-day evaluation.

Figure A-3  Windows Server 2019 download web page

Save the ISO file in a place that you can access from the machine on which you install Workstation 16 Pro. You’ll need approximately 5GB of disk space to store this Windows Server ISO file.

Linux

Visit https://ubuntu.com/download/server and select the Option 3 button to download Ubuntu Server 20.04.1 LTS, or whatever the newest version is.

The machine on which you plan to run Workstation 16 Pro must have access to the ISO file. You can even store the ISOs on a USB flash drive with enough space if you choose. You’ll need approximately 1GB of disk space to store this Linux ISO file.

Figure A-4  Ubuntu Server 20.04.1 LTS download web page

Lab Exercise Miscellany

When installing both the Windows and Linux operating systems in Workstation Pro during the lab exercises, you’ll be prompted to specify a password. Passwords expire, so if you must change your password, take careful note of it. The lab exercises provide the original installation password, but if you changed the password, you’ll have to enter that instead.

The lab exercises correspond to the topics covered in each chapter, and the interesting thing is that some labs are written for the Windows Server operating system, while others are written for the Linux operating system. This means you’ll get great exposure to common administrative tasks on both platforms.

Topics covered in the labs range from installing server operating systems to configuring server roles such as Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), encrypting files using the Encrypting File System (EFS) and OpenSSL, setting file system permissions, using performance monitoring tools, and using backup tools, to name a few. The labs are designed to be performed sequentially from Chapter 2 through Chapter 8; failure to do them in order will cause confusion.

Even though every lab may not mention it, if you have plenty of free disk space, you may want to take a virtual machine snapshot of each virtual machine after you successfully complete the lab exercises in each chapter. This way, you can easily revert back to the original configuration if something goes wrong in a future lab.

As you perform each step in a lab exercise, always ask yourself, “Why am I doing this?” to make sure you’re getting the most out of the exercise. Learn lots, and have fun!

APPENDIX B

Objective Map

Exam SK0-005

The following objective map has been constructed to enable you to cross-reference the official exam objectives with the objectives as they are presented and covered in this book. References have been provided for the objective exactly as the exam vendor presents it, the section of the exam guide that covers that objective, and a chapter reference.

CompTIA Server+ Certification Exam SK0-005

APPENDIX C

About the Online Content

This book comes complete with TotalTester Online customizable practice exam software with more than 200 practice exam questions, including 10 simulated performance-based questions.

System Requirements

The current and previous major versions of the following desktop browsers are recommended and supported: Chrome, Microsoft Edge, Firefox, and Safari. These browsers update frequently, and sometimes an update may cause compatibility issues with the TotalTester Online or other content hosted on the Training Hub. If you run into a problem using one of these browsers, please try using another until the problem is resolved.

Your Total Seminars Training Hub Account

To get access to the online content, you will need to create an account on the Total Seminars Training Hub. Registration is free, and you will be able to track all your online content using your account. You may also opt in if you wish to receive marketing information from McGraw Hill or Total Seminars, but this is not required for you to gain access to the online content.

Privacy Notice

McGraw Hill values your privacy. Please be sure to read the Privacy Notice available during registration to see how the information you have provided will be used. You may view our Corporate Customer Privacy Policy by visiting the McGraw Hill Privacy Center. Visit the mheducation.com site and click Privacy at the bottom of the page.

Single User License Terms and Conditions

Online access to the digital content included with this book is governed by the McGraw Hill License Agreement outlined next. By using this digital content you agree to the terms of that license.

Access  To register and activate your Total Seminars Training Hub account, simply follow these easy steps.

1.   Go to this URL: hub.totalsem.com/mheclaim

2.   To register and create a new Training Hub account, enter your e-mail address, name, and password on the Register tab. No further personal information (such as credit card number) is required to create an account.

If you already have a Total Seminars Training Hub account, enter your e-mail address and password on the Log in tab.

3.   Enter your Product Key: 33ms-65wk-smvn

4.   Click to accept the user license terms.

5.   For new users, click the Register and Claim button to create your account. For existing users, click the Log in and Claim button.

You will be taken to the Training Hub and have access to the content for this book.

Duration of License  Access to your online content through the Total Seminars Training Hub will expire one year from the date the publisher declares the book out of print.

Your purchase of this McGraw Hill product, including its access code, through a retail store is subject to the refund policy of that store.

The Content is a copyrighted work of McGraw Hill, and McGraw Hill reserves all rights in and to the Content. The Work is © 2021 by McGraw Hill.

Restrictions on Transfer  The user is receiving only a limited right to use the Content for the user’s own internal and personal use, dependent on purchase and continued ownership of this book. The user may not reproduce, forward, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish, or sublicense the Content or in any way commingle the Content with other third-party content without McGraw Hill’s consent.

Limited Warranty  The McGraw Hill Content is provided on an “as is” basis. Neither McGraw Hill nor its licensors make any guarantees or warranties of any kind, either express or implied, including, but not limited to, implied warranties of merchantability or fitness for a particular purpose or use as to any McGraw Hill Content or the information therein or any warranties as to the accuracy, completeness, correctness, or results to be obtained from, accessing or using the McGraw Hill Content, or any material referenced in such Content or any information entered into licensee’s product by users or other persons and/or any material available on or that can be accessed through the licensee’s product (including via any hyperlink or otherwise) or as to non-infringement of third-party rights. Any warranties of any kind, whether express or implied, are disclaimed. Any material or data obtained through use of the McGraw Hill Content is at your own discretion and risk and user understands that it will be solely responsible for any resulting damage to its computer system or loss of data.

Neither McGraw Hill nor its licensors shall be liable to any subscriber or to any user or anyone else for any inaccuracy, delay, interruption in service, error or omission, regardless of cause, or for any damage resulting therefrom.

In no event will McGraw Hill or its licensors be liable for any indirect, special or consequential damages, including but not limited to, lost time, lost money, lost profits or good will, whether in contract, tort, strict liability or otherwise, and whether or not such damages are foreseen or unforeseen with respect to any use of the McGraw Hill Content.

TotalTester Online

TotalTester Online provides you with a simulation of the CompTIA Server+ SK0-005 exam. Exams can be taken in Practice Mode or Exam Mode. Practice Mode provides an assistance window with hints, references to the book, explanations of the correct and incorrect answers, and the option to check your answer as you take the test. Exam Mode provides a simulation of the actual exam. The number of questions, the types of questions, and the time allowed are intended to be an accurate representation of the exam environment. The option to customize your quiz allows you to create custom exams from selected domains or chapters, and you can further customize the number of questions and time allowed.

To take a test, follow the instructions provided in the previous section to register and activate your Total Seminars Training Hub account. When you register, you will be taken to the Total Seminars Training Hub. From the Training Hub Home page, select your certification from the Study drop-down menu at the top of the page, or from the list of Your Topics on the Home page, and then click on the Total Tester link to launch the Total Tester. You can then select the option to customize your quiz and begin testing yourself in Practice Mode or Exam Mode. All exams provide an overall grade and a grade broken down by domain.

Performance-Based Questions

In addition to multiple-choice questions, the CompTIA Server+ (SK0-005) exam includes performance-based questions (PBQs), which, according to CompTIA, are designed to test your ability to solve problems in a simulated environment. More information about PBQs is provided on CompTIA’s website. You can access the PBQs included with this book by navigating to the Resources tab and selecting the quiz icon. You can also access them by navigating to and selecting CompTIA Server+ All-in-One (SK0-005) Resources from the Study drop-down menu at the top of the page or from the list of Your Topics on the Home page. After you have selected the PBQs, an interactive quiz will launch in your browser.

Technical Support

For questions regarding the TotalTester or operation of the Training Hub, visit www.totalsem.com or e-mail support@totalsem.com.

For questions regarding book content, visit www.mheducation.com/customerservice.

GLOSSARY  

1-phase power  Designed for moderate power requirements, this type of AC power is normally used in households.

1U  Unit of height measurement for racks and rack-mounted equipment. 1U equals 1-3/4 inch.

3G  Third-generation wireless telecommunications network.

3-phase power  Designed for demanding power requirements, this type of AC power is normally used in industrial environments and data centers.

4G  Fourth-generation wireless telecommunications network; speeds are faster than 3G, and it supports more broadband applications.

6to4  An IPv6 transition technology that allows IPv6 traffic over the IPv4 Internet. Routers on both ends must support IPv6, and each must have an IPv6 address configured on its internal interface.

A  Domain Name Service (DNS) record type that resolves fully qualified domain names (FQDNs) to IPv4 addresses.

AAAA  DNS record type that resolves FQDNs to IPv6 addresses.

access control list (ACL)  A list of entities such as users and groups that are granted or denied permission to access a resource such as a file.

access control vestibule  See mantrap.

Active Directory Domain Services (AD DS)  Microsoft’s Lightweight Directory Access Protocol (LDAP)–compliant network database containing objects such as users, groups, and computers. The database is replicated between domain controller servers and is used for authentication, centralized Group Policy settings, and storage of some network application configurations including Domain Name System (DNS) and activation keys.

Active Directory Federation Services (ADFS)  Microsoft’s Identify Federation solution used for web Single Sign-On (SSO). ADFS can be configured with user and device claim types that are consumed by trusting applications. Claims are digitally signed by ADFS using a private key; trusting applications verify the signature with the related public key.

Advanced Encryption Standard (AES)  A symmetric block cipher available in 128-bit, 192-bit, and 256-bit cipher strengths. It supersedes the Data Encryption Standard (DES).

Advanced Intelligent Tape (AIT)  A magnetic tape storage medium used with tape backup and archiving systems.

Advanced RISC Machine (ARM)  A 32-bit and 64-bit multicore processor type used in small computing devices such as smartphones.

air-gapped network  A type of network that does not have a connection to the Internet either wirelessly or using a wired connection. This isolated network can be used for testing purposes or highly sensitive networks.

alternating current (AC)  A type of power that uses small variations in voltage and current; it is available from power outlets and consumed by power supplies.

AMD Virtualization (AMD-V)  AMD’s virtualization firmware support that is required by some Type 1 and Type 2 hypervisors.

anycast  Similar to multicasting, this IPv6 transmission method attempts to find the nearest receiver of a multicast group.

application server  A server configured to serve a specific business need beyond core functionality, such as a generic file server or database server.

asynchronous replication  A data replication method in which a delay occurs after the initial data write before the secondary write takes place.

Automatic Private IP Address (APIPA)  A self-assigned unique LAN IPv4 address that Windows devices use when the Dynamic Host Configuration Protocol (DHCP) server is unreachable. APIPA devices can communicate only with other APIPA devices on the LAN.

autoscaling  An IT service configuration, normally for load balancing, that can add virtual machines (scaling out) or remove virtual machines (scaling in) based on a schedule or metric threshold configuration.

bare metal  A term used to describe installation or disaster recovery scenarios in which a computer system has no operating system installed.

baseboard management controller (BMC)  An interface between server management tools and the physical server hardware being managed. The BMC also monitors the state of servers and is often used with blade servers.

battery-backed write caching  Used with disk array controllers upon restart for data not yet written to disk. Because it is cached (it is not lost during a power cycle), data gets written to disk.

binary  Numeric system consisting of 0’s and 1’s.

biometric authentication  Uses a personal identifying characteristic for proof of identity, such as a fingerprint or retinal scan.

BIOS  Basic input-output system; the firmware instructions embedded on a motherboard that provide basic hardware functionality including the initial power on self test (POST) sequence when the machine is powered on.

BitLocker  Microsoft’s disk volume encryption tool. Although it can be used without the Trusted Platform Module (TPM), it is designed to use TPM functionality.

blade enclosure  Blade servers (essentially server motherboards) are placed into a blade enclosure, which is mounted into a rack. Since each blade does not have its own cooling, networking, and power, this is supplied through the enclosure.

blade server  A thin server that is placed into a blade enclosure that provides cooling, networking, and power. Blade servers increase server density in data centers compared to rack-mounted and tower servers.

botnet  A group of infected computers under centralized malicious user control. The malicious user can provide instructions for the group of computers, much like an army general ordering soldiers to attack an adversary.

bring your own device (BYOD)  A policy that enables people to bring their own personal computing devices into a business environment. In corporate environments using mobile devices, the company often exercises control over business apps, settings, and data on the device in a separate logical device partition that can be selectively wiped, while leaving personal apps, settings, and data intact.

British thermal units (BTUs)  A standard way to measure the heat output of computing equipment, which can be used to determine cooling requirements from the HVAC system.

broadcast  A transmission received by all network nodes on the LAN. Network broadcasts can apply at the hardware or software level. Routers do not forward broadcasts by default.

buffer overflow  An exploit that provides more data than the programmer intended in memory, which can lead to remote escalation attacks. Secure coding practices can prevent this from happening.

bus width  Buses are sets of conductors that carry data (bits) around the computer, and a computer consists of various buses. The bus width, or size, is commonly 32 or 64 bits.

business continuity plan (BCP)  Proactive planning that ensures that business operations continue when negative incidents occur; the plan is not as detailed or specific as a disaster recovery plan.

business impact analysis (BIA)  Identifies the degree and scope of impact on a business when negative incidents occur. The BIA enables easier prioritization of assets that require protection from threats.

cable management arm  In equipment racks, a folding arm that holds cables. When rack equipment is slid out on rack rails, the arm extends to provide longer cable lengths.

cache  A small amount of high-speed memory used to fetch recent instructions or data.

CAT3  Category 3 copper-wire network cabling that is designed to support up to 10 Mbps.

CAT5  Category 5 copper-wire network cabling that is designed to support up to 100 Mbps; also called 100Base-T or Fast Ethernet.

CAT5e  Category 5 copper-wire network cabling that is designed to support up to 1000 Mbps (1 Gbps); also called 1000Base-T or Gigabit Ethernet.

CAT6  Category 6 copper-wire network cabling that is designed to support up to 10 Gbps. It is more resistant to interference than CAT5 and has more twists per foot in the cable. Also called 10GBase-T. Longer cable distances (approximately 60 to 100 meters) can be run at 1 Gbps.

CAT7  Category 7 copper-wire network cabling that is designed to support up to 10 Gbps; uses individual wire pair shielding, which makes it useful in environments with high electromagnetic interference (EMI).

central processing unit (CPU)  A microprocessor chip on a motherboard that carries out instructions within the system. Modern CPU chips consist of multiple logical CPU cores within a single physical chip.

certificate authority (CA)  Issuer of digital security certificates in a Public Key Infrastructure (PKI). Companies can create their own CAs or use certificates issued from trusted third-party CAs.

checkpoint  Also called a snapshot, a checkpoint takes a point-in-time picture of virtual machine settings and data disks. This can also refer to disk volume snapshots, which copy only disk blocks changed since the previous snapshot.

cipher  An algorithm used for encryption, decryption, or hashing mathematical operations.

Classless Inter-Domain Routing (CIDR)  A shorthand way of referring to the number of bits in a network mask. For example, /24 can be used to represent 255.255.255.0.

clock multiplier  Defines a relationship between the external CPU bus speed (MHz) versus the internal CPU speed (GHz).

cloud  Pooled computing resources that can be self-provisioned rapidly, usually over the Internet. IT resource usage is metered so that consumers pay for only what they use. Cloud computing resources must be available from anywhere, at any time, using any type of device.

CMOS  Complementary metal oxide semiconductor; battery-powered firmware used to retain hardware settings available in the BIOS.

cold aisle  In data centers, cold aisles feed cool air to equipment intake fans to manage airflow for equipment and for cost optimization.

cold site  An alternate data center space that can be used in the event of a disaster at the original site. The site has power and communications links but no computing equipment, staff, or data.

column access strobe (CAS) latency  A memory characteristic that defines how long it takes for requested memory content to leave the actual memory chip on its way to the bus.

Command and Control (C&C, C2)  A server under malicious user control that provides instructions to hosts infected with malware. Infected hosts (zombies) or collections of zombies (botnets) periodically contact the C&C server for instructions.

Common UNIX Printing System (CUPS)  The standard UNIX print server software components.

community cloud  A cloud deployment model adhering to the five NIST cloud computing characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity or expansion, and measured service) that provides IT services to groups with the same computing needs, such as government agencies or specific industries.

CompactFlash  A small storage card used in devices such as cameras and audio recorders, similar to an SD card. The device determines whether SD cards or CompactFlash storage must be used. See also Secure Digital (SD) card.

Complex Instruction Set Computing (CISC)  A microprocessor design used in larger non-mobile computing devices such as desktops and servers. This type of chip is designed not for energy efficiency but for performance.

confidentiality  Provided by encryption, confidentiality prevents the disclosure of sensitive information to unauthorized users.

continuous data protection (CDP)  Real-time replication (synchronous) often used for data between data centers.

converged network adapter (CNA)  Server expansion card that combines Ethernet and Fibre Channel functionalities.

CPU cache  High-speed memory used to keep recently executed data or CPU instructions readily available for subsequent use.

cross-over cable  Cable used to link two network computing devices directly together, in which receive and transmit wires are reversed on either end. This type of cable can also be required by older network equipment—to link two old Ethernet switches together, for example.

crosstalk  Interference caused by electronic signals on adjacent wires. It can be reduced with wire shielding and by twisting wire pairs together a specific amount of times per foot. The more twists per foot, the less crosstalk, which means transmissions at higher frequencies are possible.

customer replaceable units (CRUs)  Components provided under warranty by a vendor that are installed by the customer.

daemon  A background process on a UNIX or Linux system not tied to a user session. Examples include the sshd daemon for remote management and the syslogd daemon for logging.

data center  A facility dedicated to housing computing equipment. Special designs enforce security; control HVAC; improve resistance to floods, fire, and earthquakes; and have backup power and communications solutions.

Data Collector Set (DCS)  A Microsoft Windows Performance Monitor configuration that enables the addition of multiple metrics that can be scheduled to monitor hosts for a period of time; useful for establishing Windows host performance baselines.

data deduplication  A storage mechanism designed to save storage space by removing redundant data blocks.

data loss prevention (DLP)  A solution that prevents sensitive data from leaving the organization or prevents intellectual property from becoming available to unauthorized users.

daughter card  An expansion circuit board that gets plugged into a motherboard. Unlike a normal expansion card, daughter cards have direct access to CPU and memory resources.

DDR3  Double Data Rate Type 3 memory; a type of dynamic RAM supported by some motherboards. DDR transmits data on the rise and fall of computer clock signals.

DDR4  Double Data Rate Type 4 memory; a type of dynamic RAM supported by some motherboards where speeds are faster than DDR3. DDR transmits data on the rise and fall of computer clock signals.

deep packet inspection  Ability to access data beyond packet header fields for application-specific data. Packet payloads can be examined, often for the purposes of security or performance. Also called OSI Layer 7 inspection.

default gateway  The IP address of a router interface on the LAN, which is used by nodes to transmit data to remote networks.

demilitarized zone (DMZ)  A network whose hosts are exposed to the Internet with controlled access to an internal network. Services that must be reached from the Internet such as virtual private networks (VPNs) and public web sites should be placed in the DMZ. An alternative is to use a reverse proxy in the DMZ that listens for requests and forwards them to the actual servers located on a protected internal network. Also called a screened subnet.

denial-of-service (DoS) attack  An attack that prevents the legitimate use of a computing resource—for example, by flooding a host with specially crafted packets to cause the host to crash.

Desired State Configuration (DSC)  A Microsoft PowerShell method of centrally configuring and hardening Windows and Linux hosts.

differential backup  A backup method in which changed items since the last full or differential backup are copied. The archive bit is not cleared with this type of backup.

Digital Linear Tape (DLT)  The industry standard for tape backup media, DLT is often used for long-term archiving. DLT cartridges should be placed in protective cases to ensure long-term data storage.

digital rights management (DRM)  A solution that ensures that only valid subscribers have access to protected intellectual properties such as movies, music, games, and so on.

digital signature  A unique value generated by a private key along with data such as an e-mail message. The signature is verified on the receiving end with the mathematically related public key and can be used to assure the recipient that the sender is who they say they are and that the transmission has not been tampered with.

direct-attached storage (DAS)  Local storage available to a server. If the server does not have to communicate with storage over some kind of network, it is DAS.

direct current (DC)  As opposed to alternating current (AC) from power outlets, DC provides a consistent voltage and amperage to sensitive digital components. Batteries and power supplies provide DC.

disaster recovery (DR) plan  A plan that is specific to an IT system that includes a step-by-step procedure for recovering an IT system as quickly and efficiently as possible after a disaster occurs.

discretionary access control list (DACL)  A file system permissions model whereby the data custodian sets file system permissions in accordance with policies set by the data owner.

disk mirroring  Also called RAID 1, data written to one disk is also written to a second disk in case the first disk fails. With RAID 1, 50 percent of the storage capacity is usable, and it is considered a fault-tolerant disk solution.

disk scrubbing  A method of removing data from a disk to ensure that data remnants cannot be resurrected and data reconstructed. This method normally uses multiple passes to write useless random data to the hard disk.

disk striping  Also called RAID 0, this distributes written data across multiple disks with the result being improved performance. Other RAID variations use different forms of striping along with parity, or recovery information, to gain the additional benefit of fault tolerance; an example of this is RAID 5.

distributed denial-of-service (DDoS)  Very similar to a DoS, this attack prevents the legitimate use of a computing resource. For example, flooding a host with specially crafted packets could cause the host to crash, but what makes a DDoS attack different from a DoS attack is that multiple hosts under malicious user control are involved in executing the attack against the victim host or network.

DNS forward lookup  The most common type of lookup. Queries for the IP address given a fully qualified domain name (FQDN) (such as www.fakesite.com) are received by the DNS server, and the IP address is returned to the query originator.

DNS reverse lookup  Queries a reverse zone for a FQDN given the IP address, and the FQDN is returned to the query originator.

domain controller (DC)  A Windows server that holds a replica of the Active Directory database. The server is discovered in Domain Name Service (DNS) through service location records and performs authentication and replication with other domain controllers, and it provides Group Policy settings.

Domain Name Service (DNS)  A network service that listens on UDP port 53 for client queries. A forward DNS lookup is the most common type of query, in which the client has a FQDN but needs the corresponding IP address. Multiple DNS servers can be used for high availability and better performance. Microsoft Active Directory requires DNS.

double data rate (DDR)  A feature of memory chips in which data is transmitted on the rise and fall of a timing signal.

Dual Inline Memory Module (DIMM)  A common type of memory circuit board with multiple memory chips that plug into sockets on a motherboard. DIMMs can have 168, 184, or 240 pins.

Dynamic Access Control (DAC)  A feature that enables administrators to grant permissions to a resource if certain conditions are met. Conditions can be expression-based, such as “full-time employees only,” or “users must be members of two specific groups and be based in Chicago,” for example, as opposed to users simply being members of a group and thus receiving group permissions.

Dynamic Host Configuration Protocol (DHCP)  A network management protocol in which centralized IPv4 and IPv6 settings are deployed to DHCP clients. Clients initially discover DHCP servers using software broadcasts that cannot traverse routers, in which case a DHCP relay agent would be required.

dynamic random access memory (DRAM)  A classification for memory that requires constant electricity to retain data stored in memory cells. This is the most common type of main system memory.

Edison plug  A type of electrical plug that is standard in American households and is more rounded than NEMA (National Electrical Manufacturers Association) plugs, but like NEMA, it has three prongs.

electromagnetic interference (EMI)  Also called radiofrequency interference. Some equipment, or even adjacent wires within a cable, can emit this electrical noise, which can interfere with other electronic transmissions in close proximity.

electrostatic discharge (ESD)  Differences in electrical potential between two items result in electrons flowing to the lesser charge in an attempt to equalize voltage. This exchange can damage sensitive electronic circuits and can be reduced with ESD wrist straps or ESD mats.

Encrypting File System (EFS)  Microsoft file and folder encryption. Unlike BitLocker, EFS does not rely on Trusted Platform Module (TPM). EFS decryption is dependent upon the user being successfully authenticated. BitLocker disk volume encryption is in no way related to user accounts.

encryption  Scrambling of data using a mathematical algorithm with a key to change plaintext into cipher text (encrypted data). Encryption ensures that only authorized users (those with the decryption key) can access private data.

error correcting code (ECC)  A type of memory chip often used in servers that can detect and also correct certain types of data corruption errors in memory.

Ethernet switch  A network device with multiple physical ports where network nodes such as servers, desktops, and routers can be plugged in. Multiple switches can be linked together with a straight-through cable, although older switches may require a cross-over cable. Layer 3 switches add routing capabilities. Most switches are manageable over the network using Telnet, SSH, HTTP, or HTTPS.

exabyte  One quintillion, or 10¹⁸, bytes.

execute disable (XD)  A CPU option that, when enabled, flags specific areas of memory where data can reside and code cannot execute.

EXT3  The Extended File System, a UNIX and Linux file system. This journaled file system is used with many Linux distributions.

EXT4  A journaled UNIX and Linux file system. Compared to EXT3, EXT4 supports larger files and file system sizes, and journaling can be disabled.

Extended File Allocation Table (exFAT)  A Microsoft file system often used with Secure Digital (SD) cards and USB flash drives.

External SATA (eSATA)  Similar to SATA, except that the interface connector is external to the device; some devices have a built-in eSATA port. See also Serial AT Attachment (SATA).

failover cluster  Two or more servers that offer the same IT service to maintain constant communication. When a cluster node fails, users are redirected to a remaining node that offers the same network service.

fiber-optic cable  A type of cable that transmits pulses of light rather than electrical signals through tiny glass or plastic tubes. Signals can travel much farther on fiber-optic cable than copper wires before degrading, and additional security is provided because it is difficult to wiretap fiber-optic cables. Single-mode fiber (SMF) is often used for longer distances; multi-mode fiber (MMF) is used for shorter distances. See also multi-mode fiber (MMF) and single-mode fiber (SMF).

Fibre Channel (FC)  Enterprise-class, high-speed network connecting servers to storage. FC uses special equipment such as FC host bus adapter cards in servers and FC switches, to name a few. FC does not require the use of fiber-optic cables, although this is common.

Fibre Channel host bus adapter (FC HBA)  Servers that access storage over a Fibre Channel storage network require at least one FC HBA. Multiple FC HBAs enable multiple paths from the server to network storage and provide fault tolerance.

Fibre Channel over Ethernet (FCoE)  A standard designed to place disk commands into Ethernet frames as opposed to using higher level IP packets, which introduce more overhead. Special equipment is required.

field replaceable units (FRUs)  A computer component that can be quickly and easily removed from a computer or other piece of electronic equipment and replaced by the user or a technician without having to send the entire product or system to a repair facility. Certified technicians follow proper procedures when replacing failed components such as Fibre Channel HBAs or motherboards.

File Allocation Table 32 (FAT32)  A Microsoft file system from the 1990s. Although rarely used for hard disks, it is still used occasionally for smaller USB flash drives.

file encryption key (FEK)  A bulk encryption key used with Microsoft EFS. User private keys (after successful authentication) are used to decrypt the FEK, which is then used to decrypt EFS-encrypted files or folders.

file integrity  See hashing.

File Transfer Protocol (FTP)  A network protocol used to transfer files between servers and clients on a network. FTP servers normally listen on TCP ports 20 and 21.

firewall  A hardware or software solution that controls network traffic into or out of an individual host or an entire network.

firmware  Software stored in a chip.

form factor  An aspect that defines the physical size and shape of a component.

front side bus (FSB)  A communications interface that carries data between the CPU and the northbridge.

FTPS (FTP Secure)  An extension of FTP that supports the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) cryptographic protocols.

full backup  A backup in which all selected files and folders are backed up. The archive bit is normally cleared.

full-duplex  Transmission of data in two directions; information can be sent and received simultaneously.

full wipe  All information on the system is completely deleted.

fully qualified domain name (FQDN)  The complete domain name of a specific computer/host on the Internet, such as www.mheducation.com.

geofencing  A virtual barrier of geographic boundaries created by a feature in a program using GPS. This is often used to control mobile device apps or web sites.

gigabit (Gb)  A unit of digital information equivalent to 125 megabytes.

gigabyte (GB)  A unit of digital information equivalent to about 1 billion bytes, or 1000 megabytes.

grandfather-father-son (GFS)  A backup rotation method that uses three backup sets such as daily, weekly, and monthly, where each tape gets rotated on a schedule. You could use quarters and years as backup cycles for even longer term archiving.

graphics processing unit (GPU)  A specialized processor designed to handle computationally intensive graphic operations, thereby freeing up the CPU(s) in the server to process other instructions.

Group Policy  A Windows feature that defines user, security, and network policies. Group Policy can be configured locally on a single host or centrally through Group Policy Objects (GPOs).

Group Policy Object (GPO)  An Active Directory object that contains specific policy settings for defined groups of users or computers.

guest  A virtualized OS running on a hypervisor host.

GUID Partition Table (GPT)  A layout of the partition table on a storage device such as a hard disk drive or a solid-state drive that uses globally unique identifiers (GUIDs). GPT provides up to 128 disk partitions compared to the master boot record (MBR) maximum of 4.

half-duplex  A system in which information can be both sent and received, but not at the same time.

hard disk drive (HDD)  A magnetic data storage device that stores information on rigid, rotating platters.

hardening  Securing a system by reducing its attack surface, usually by removing unneeded services or programs and applying patches.

hardware compatibility list (HCL)  A list of hardware that is compatible with a specific operating system.

hashing  A process in which mathematical algorithms are used with data to result in a unique value, or hash. Hashing can be done on a file or transmission at a future time to detect whether the file or transmission was modified since the last hash. Modifications result in a different hash.

Health Insurance Portability and Accountability Act (HIPAA)  A piece of legislation passed in the United States in 1996. Title II of this legislation deals with how digital healthcare/patient information should be stored, as well as privacy and security rules regarding this digital information.

heating, ventilation, air conditioning (HVAC)  A system that provides comfort and acceptable air quality indoors and in vehicles, including heat, ventilation, and air conditioning, as well as humidity control. This is especially critical in data centers that house hundreds or thousands of computing devices.

hexadecimal  A numerical system made up of 16 symbols (base 16) from 0 to 9, A to F, where A = 10 and F = 15.

high availability  Continuous access to data or IT systems. Disk mirroring, backups, and failover clustering provide high availability.

host  The software that is installed on a system that interfaces with the underlying hardware directly. This term is often used to refer to a virtualization server.

host bus adapter (HBA)  A circuit board that connects a host to other storage and network devices.

host intrusion detection system (HIDS)  A system that monitors a computer system, logs suspicious activity, and alerts administrators. A HIDS must be tweaked for a specific environment and can be configured against a baseline of normal activity.

host intrusion prevention system (HIPS)  A system that monitors a computer system, logs suspicious activity, and alerts administrators, but it also has the ability to stop the activity from continuing. A HIPS must be tweaked for a specific environment and can be configured against a baseline of normal activity.

HOSTS file  A file on network devices used to map hostnames to IP addresses. The HOSTS file is checked before DNS servers.

hot aisle  A row in a data center in which the exhaust fans of server racks are facing one another. Cool air from the cold aisle is supplied to equipment intake fans. The goal is to keep equipment cool and energy costs down.

hot site  A duplicate of an original network equipment site that would enable a business to continue computer and network operations during a disaster. Power, communications equipment, software, data, and staff are ready to go. This relies on data replication from the original site to the hot site.

hot spare  An extra component that can be used immediately when a primary component fails.

human interface device (HID)  A computer device that interfaces directly and takes input from people, such as a stylus, mouse, or keyboard.

hybrid cloud  A cloud deployment model that combines public and private clouds. See also private cloud and public cloud.

Hypertext Markup Language (HTML)  A set of markup tags that are used to create web documents.

Hypertext Transfer Protocol (HTTP)  An application protocol for distributed information systems. Web servers use HTTP to deliver HTML content to web browsers and normally listen on TCP port 80 or 443 for secured connections.

Hypertext Transfer Protocol Secure (HTTPS)  HTTP communication that is encrypted with Transport Later Security (TLS) or Secure Sockets Layer (SSL), which requires the web server to be configured with a Public Key Infrastructure (PKI) certificate. The server normally listens on TCP port 443 for this type of connection.

hypervisor  A program that enables multiple guest operating systems running in virtual machines to share the resources of a single host. Type 1 hypervisors interact directly with underlying hardware, whereas Type 2 hypervisors require an existing operating system and do not interact directly with hardware.

identity federation  A centralized and trusted identity store. Apps don’t have to handle authentication themselves; instead, they consume trusted security tokens from the identity provider (IDp).

identity provider (IDp)  A centralized and trusted identity store that digitally signs authorization tokens after successful authentication. These tokens are then consumed by apps configured to trust the IDp.

IEEE 802.1X  An Institute of Electrical and Electronics Engineers (IEEE) standard that defines port-based network access control, which controls device access to a network. Wireless access points, network switches, and VPN devices are examples of devices that can be 802.1X-compliant.

incremental backup  A backup of files that have changed since the last full or incremental backup. This type of backup clears the archive bit and takes the least amount of time to back up but the most amount of time to restore.

Information Technology Infrastructure Library (ITIL)  A service management and delivery methodology that strives for the continuous improvement and efficiency of provided IT services.

Infrastructure as a Service (IaaS)  A cloud service model in which providers offer infrastructure such as virtual machines and storage as a self-provisioned service to subscribers. Subscribers can rapidly provision and deprovision these services and pay for only what they use.

input/output operations per second (IOPS)  A unit of measurement for the maximum number of reads and writes a storage device can perform per second.

Integrated Dell Remote Access Controller (iDRAC)  A platform designed to enable administrators to connect to remote servers at the hardware level, even using a friendly web browser interface. This requires an additional IP configuration because the server OS does not have to be running.

Integrated Lights Out (ILO) management  A technology from Hewlett-Packard that offers secure remote management capabilities, as well as server monitoring and alerting capabilities.

Intel Virtualization Technology (Intel VT)  Intel’s hardware virtualization support required by some hypervisors.

Intelligent Platform Management Interface (IPMI)  A remote server management solution commonly used with various vendors’ blade enclosures. IPMI also provides server monitoring and inventory functionality.

Internet Control Message Protocol (ICMP)  A protocol of the TCP/IP suite used to check for network connectivity issues. Tools such as ping and tracert use ICMP.

Internet Message Access Protocol (IMAP)  An e-mail protocol that stores e-mails while also enabling the end user to view and change the e-mails from multiple devices. IMAP normally listens on TCP port 143 or 993 if enabled for Secure Sockets Layer (SSL) or Transport Layer Security (TLS).

Internet Protocol (IP)  The primary communications protocol for relaying datagrams between networks. This protocol maps to Layer 3 (the network layer) of the OSI model.

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)  Allows IPv6 traffic on an internal IPv4 network. The IPv4 address is embedded within the IPv6 address.

intrusion detection system (IDS)  A device or program that monitors a network or system for security violations or malicious activity.

intrusion prevention system (IPS)  A device or program that monitors network traffic for security violations or malicious activity and can prevent the activity from continuing.

IPSec (IP Security)  Network security that works with IPv4 and IPv6; it enables encryption and authentication of network packets without application-specific configurations.

IPv4  The fourth revision of the Internet Protocol. Still used by the majority of networks today, although all free addresses have been exhausted. IPv4 uses a 32-bit address space where addresses are expressed in decimal form, such as 192.168.1.1.

IPv6  The sixth revision of the Internet Protocol. Gaining traction, it is a 128-bit address space where addresses are expressed in hexadecimal form, such as 2000:1:234::1.

iSCSI (Internet Small Computer Systems Interface)  iSCSI disk commands are placed into IP packets; this enables servers to connect to network storage using standard network equipment. iSCSI initiators consume disk space over the network from iSCSI targets.

Kerberos  A network authentication protocol that uses tickets to identify computers over a nonsecure network; used by Active Directory.

key management service (KMS)  A Microsoft Windows server that issues and tracks licenses for an entire site.

keyboard, video, mouse (KVM)  A switch used to connect a single keyboard, video, and mouse to multiple servers. Newer solutions enable KVM over IP.

kilobyte (KB)  A unit of digital information equivalent to about 1000 bytes.

kilowatt (kW)  A unit of electrical power that equals 1000 watts, often used for UPS power ratings, although sometimes the rating is in volt-amperes (VA).

L1 cache  Level 1 cache, the fastest cache available to the CPU. Located on the CPU die.

L2 cache  Level 2 cache, the next fastest cache available to the CPU after L1 cache. Located on the CPU die.

L3 cache  Level 3 cache, the next fastest cache available to the CPU after L2 cache. Located on the CPU die.

large form factor (LFF)  A 3-1/2-inch hard disk drive. See also small form factor (SFF).

Layer 2 Tunneling Protocol with IP Security (L2TP/IPSec)  A VPN solution in which IPSec encrypts data using a variety of sources for keys, including a symmetric key, PKI certificates, Kerberos, and so on.

lights-out management (LOM)  The use of a dedicated management channel that enables administrators to monitor servers even when they are powered off.

Lightweight Directory Access Protocol (LDAP)  A protocol for using and maintaining a distributed directory information service over a network. Microsoft Active Directory is LDAP-compliant.

Linear Tape-Open (LTO)  Magnetic storage media that uses the Linear Tape File System (LTFS).

Linux  A UNIX-like operating system that was created and is maintained under the free and open-source software development and distribution model.

logical unit number (LUN)  A number that identifies available storage on a storage area network (SAN).

LT connector  Fiber-optic snap-in connector commonly used with single-mode fiber.

mail exchanger (MX) record  A resource record in DNS that specifies a mail server responsible for a specific domain.

main distribution frame (MDF)  Cable racks that organize data cabling from intermediary distribution frames (IDFs), which organize cables plugged into equipment.

malware  Malicious software such as a virus, worm, and spyware.

management information base (MIB)  A database of configuration settings and statistics present on most network devices; queries from a Simple Network Management Protocol (SNMP) management console.

mandatory access control (MAC)  A permissions model whereby the operating system determines resource access based on configured policies. Operating systems such as Security Enhanced Linux (SELinux) support this access control model.

mantrap  A room with two sets of interlocking doors; the first set of doors must be closed and locked before the second set will open to allow a person through.

master boot record (MBR)  A type of boot sector at the beginning of PC partitioned storage devices.

media access control (MAC) address  A unique 48-bit hexadecimal address assigned to a network interface either by the vendor or through software.

megabit (Mb)  A unit of digital information equivalent to 125 kilobytes.

megabyte (MB)  A unit of digital information equivalent to about 1 million bytes, or 1000 kilobytes.

midplane  A printed circuit board (PCB) with server blades that connect on one side (the front) and other components are accessible on the other side (the back).

mobile device management (MDM)  The administration of mobiles devices, such as tablets or smartphones, using a centralized tool.

multicast  A method of sending IP datagrams to all interested listeners in a single transmission. Interested listeners must be registered with the multicast group address to receive transmissions.

multifactor authentication (MFA)  A method of computer access authentication that relies on at least two of the following: something you know, something you have, and something you are.

multihoming  A host with two or more network interfaces.

multi-mode fiber (MMF)  A type of optical fiber used to communicate over short distances.

most recently used (MRU)  A computing technique used in many different ways, in which a previously used path or memory address is consulted first before trying other options. MRU can also refer to keeping recent instructions or data in memory, but removing the oldest entries to free up memory space for current instructions or data.

Nano Server  A version of Microsoft Windows Server with a small footprint that is optimized for remote access and cloud services.

near-field communication (NFC)  A set of protocols that enables two devices to communicate when within approximately 4 centimeters (about 2 inches) of each other.

NEMA connector  The standard two-prong (or three-prong with ground) electrical plug used in North America.

network address translation (NAT)  A way of remapping one IP address space into another. The most common use is to enable internal hosts to gain Internet access where the source IP address for outgoing transmissions is translated to the NAT router’s public interface IP address.

Network File System (NFS)  A UNIX file sharing protocol that enables a computer to access files over a network.

network interface card (NIC)  A device that connects a computing device to a network. NICs have unique hardware, or Media Access Control (MAC), addresses.

network intrusion detection (NID) system  A system that is placed in a network to monitor network traffic for attacks.

network intrusion prevention (NIP) system  A system used to detect and prevent exploits or attacks on networks.

network load balancing (NLB)  A process that takes inbound traffic for a network service and distributes it to the least busy and running back-end server hosting the service. With NLB, the end user experiences better performance when accessing the network service in busy environments.

Network Time Protocol (NTP)  A protocol for clock synchronization between computers on a network over UDP port 123.

NIC balancing  See NIC teaming.

NIC bonding  See NIC teaming.

NIC teaming  Combining multiple network cards for redundancy or performance.

northbridge  Also known as a host bridge; communicates with the CPU directly through the front-side bus. This chipset connects the southbridge and other performance-sensitive components of the motherboard to the CPU.

NTFS (New Technology File System)  The file system that Windows NT operating systems use to store files on a storage device. NTFS supports auditing, compression, local file system permissions, encryption, and disk space quotas.

one-time password (OTP)  A unique numeric value used for a single authentication session; often used as an additional authentication factor.

Open Shortest Path First (OSPF)  A router protocol that finds the best path for packets as they pass through a series of connected networks.

Open Systems Interconnection (OSI) model  An effort to standardize computer networking, as with the seven-layer OSI model.

optical time domain reflectometer (OTDR)  A device used to certify the performance of fiber-optic links.

out-of-band management  The use of a dedicated channel for managing devices outside of normal communication methods.

Payment Card Industry Data Security Standard (PCI DSS)  A proprietary global security standard for companies that handle cardholder information.

PCI Express (PCIe)  The serial transmission–based PCI Express standard that supersedes both PCI and PCI eXtended (PCI-X) with more bandwidth, which is especially useful with video, storage, and network cards. The bandwidth will vary depending upon the specific version of PCIe and how many lanes (channel of communication) are used.

PCI eXtended (PCI-X)  A 64-bit parallel transmission standard that runs at various frequencies (often the case with expansion slots and cards), which influences the data transmission speed. Superseded by PCIe.

Peripheral Component Interconnect (PCI)  A standard parallel-based bus that is used to attach hardware devices to a computer.

physical-to-virtual (P2V)  A process by which a software agent running in a physical host operating system is used to re-create the host in a virtualization environment.

Platform as a Service (PaaS)  A cloud computing service that enables subscribers to run and manage applications without dealing with the difficulties of creating and maintaining the underlying infrastructure; often used by developers to quickly deploy database platforms used by applications.

plug-and-play (PnP)  A device that can be automatically discovered and used when installed while the computer is still powered on. The BIOS, operating system, and device must all support PnP.

Point-to-Point Tunneling Protocol (PPTP)  Microsoft’s standard VPN solution that uses Microsoft Point-to-Point Encryption (MPPE) for encryption. Unlike other VPN solutions, limited configuration options for encryption are available.

Port Address Translation (PAT)  An extension of NAT that enables the mapping of multiple internal IP addresses to a single public IP address. See also network address translation (NAT).

port aggregation  A network switch port configuration that groups ports together, often for the purpose of server NIC teaming.

Post Office Protocol (POP)  A protocol used by e-mail clients to retrieve messages from a server over TCP port 110 or 995 if secured with SSL or TLS.

power on self test (POST)  A process run by firmware immediately after a computer is powered on, which verifies basic power and hardware functionality.

power supply unit (PSU)  A computer component that transforms AC power supplied by the power company to lower voltage DC power for internal components.

Preboot Execution Environment (PXE)  An interface that enables a computer to boot from a server prior to booting the OS; it requires DHCP, a PXE boot server, and a PXE-enabled NIC.

principle of least privilege  A policy that states that every user, process, or program is granted access only to resources that are necessary to complete a specific task, and nothing more.

printed circuit board (PCB)  An insulating sheet of material on which conductive leads of conducting materials are placed to create electric circuits.

private branch exchange (PBX)  A telephone system used to switch calls between users on local lines while enabling users to share a limited number of external phone lines. With PBX, calls to a single phone number can ring at multiple extensions internally.

private cloud  A cloud deployment model adhering to the five NIST cloud computing characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity or expansion, and measured service), where the physical equipment is owned and used by a single organization.

PTR record  A record that resolves an IP address to a domain; used for reverse DNS lookups.

public cloud  A cloud deployment model adhering to the five NIST cloud computing characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity or expansion, and measured service), which is available to anybody over the Internet. Users must first create an account with the cloud service provider.

public key authentication  Authentication that uses a related public key and private key pair instead of the standard username and password. The public key is normally stored on the device (usually a server), while the private key is stored by the user.

Public Key Infrastructure (PKI)  A hierarchy of security certificates issued by a certificate authority to users, devices, and services. Each certificate contains many items, including a unique public and private key pair, as well as an expiry date.

quality of service (QoS)  A defined measure of performance used to prioritize different types of network traffic over others. For example, Voice over IP (VoIP) traffic is normally given a higher priority than Simple Mail Transfer Protocol (SMTP) traffic on a network.

Quad Small Form-Factor Pluggable (QSFP)  A network transceiver with four transmit and receive channels normally used for 100-Gbps fiber-optic networks.

rack-mounted server  A server designed to be placed in a rack with other servers and equipment in a server room or data center; takes less space than tower servers.

radiofrequency identification (RFID)  A way of using radiofrequencies to identify and track tags attached to objects.

random access memory (RAM)  Computer memory that retains information only when connected to a power source; thus it is considered volatile. Hard disks are considered nonvolatile memory because they retain information even with no power.

recovery point objective (RPO)  The maximum tolerable amount of data loss normally expressed in time, such as hours. If the RPO is four hours, for example, backups must occur at least every four hours.

recovery time objective (RTO)  The maximum amount of time that can be tolerated for an IT service to be down before it has a negative impact on the business.

Reduced Instruction Set Computer (RISC)  A CPU with a simplified instruction set. The few instructions that are available can be executed quickly.

Redundant Array of Independent Disks (RAID)  A configuration that combines multiple physical disks into a single unit for redundancy and/or performance purposes. RAID can be configured within an operating system or using the more reliable hardware RAID controller solution. There are many RAID levels, and each uses a different disk configuration to achieve fault tolerance and optimal performance.

ReiserFS  A journaled file system that is supported on Linux.

Remote Authentication Dial-In User Service (RADIUS)  A protocol that provides authentication, authorization, and accounting management to users who use a network service. Edge devices such as VPN appliances and wireless access points can be configured to forward authentication requests to a central RADIUS server.

Remote Desktop Protocol (RDP)  A Microsoft protocol used to provide a GUI to connect to another computer over a network; uses TCP port 3389.

Remote Installation Services (RIS)  A service that enables computers with PXE to install Microsoft operating systems remotely; superseded by Windows Deployment Services (WDS, or WinDS).

Remote Server Administration Tools (RSAT)  A Windows Server feature that enables remote management of other computers running the Windows Server OS.

Resilient File System (ReFS)  A Microsoft file system designed to succeed NTFS eventually. ReFS allows disk volume corruption repair even while the volume is mounted.

resizing  The modification of a virtual machine or cloud service to include more or less compute power in terms of virtual CPUs and RAM.

reverse proxy  A server that listens for client connections to a target network service such as a web server. The reverse proxy forwards these requests to a different host where the network service actually resides.

revolutions per minute (RPM)  Used to determine access time and read/write speed of spinning physical media such as CDs, DVDs, and hard disks.

RJ-11  A standard connector for twisted-wire pairs that is commonly used in telephony. Also used by modems.

RJ-45  A standard connector for twisted-wire pairs that is used in Ethernet networks.

rollover cable  A cable used to connect a computer directly to a router’s console port.

rotational latency  The amount of time it takes for the desired part of the disk to pass under the read/write heads of a hard disk drive.

Routing and Remote Access Service (RRAS)  A Microsoft Server service that enables the configuration of routing protocols, NAT, and VPNs.

Routing Information Protocol (RIP)  A protocol that uses hop counts as a routing metric. Each packet that passes through a router constitutes one hop.

RSA token  Used for VPN authentication, this device is synchronized with the VPN device and has a small display showing a numeric value that changes periodically, every 90 seconds, for instance.

runaway process  A process that does not respond to the system and enters an infinite loop, consuming resources and causing other resources to be unavailable until some intervention stops the process.

Samba  This term stems from Microsoft’s Server Message Block (SMB) protocol; it is an open-source product that provides Windows file and print services on various UNIX and Linux platforms.

sandbox  A tightly controlled area and set of resources in which a program can be run without risking harm to the host operating system or computer.

Serial Advanced Technology Attachment (SATA)  Common hard disk interface that transmits data serially instead of using parallel bit transmission. There are three SATA standards: SATA I, SATA II, and the newest, SATA III, which has a maximum throughput of approximately 6 Gb/s.

SC connector  Subscriber connector; a snap-in, fiber-optic cable connector that is somewhat square in shape.

scale out  To add more nodes to a system.

scale up  To add more resources to a single node.

screened subnet  See demilitarized zone (DMZ).

Secure Boot  A technology that checks the system boot loader’s cryptographic key against a list of authorized keys that are stored in firmware.

Secure Copy Protocol (SCP)  A network protocol that uses Secure Shell (SSH) for data transfers between hosts on a network.

Secure Digital (SD) card  A small data storage card used in devices such as cameras and audio recorders.

Secure File Transfer Protocol (SFTP)  FTP over SSH, which provides file access, transfer, and management over a secured connection.

Secure Shell (SSH)  A network protocol that provides administrators a secure way to access remote systems; uses TCP port 22.

Secure Sockets Layer (SSL)  An application-specific security technology for providing an encrypted link between a server and a client; requires a PKI certificate for the server.

Security as a Service (SECaaS)  A business model in which a large service provider integrates its security services with a corporate infrastructure on a subscription basis.

security information and event management (SIEM)  A centralized repository for logs, audit events, and security device alerts to detect and notify admins of suspicious activity.

seek time  The time it takes for a disk drive to access the location of stored data that is to be read.

selective wipe  A technique in which application data on mobile devices is removed, or wiped, if access to the data has been revoked, while leaving personal apps, settings, and data untouched.

serial-attached SCSI (SAS)  A serial protocol that moves data between computer storage devices and tape drives. SAS supersedes older SCSI standards that use parallel transmission.

server  A computer designed and configured to be accessed concurrently by multiple users.

server core  A minimal server installation of a Windows Server OS that does not include GUI components.

Server Message Block (SMB)  A protocol implemented in Windows for network file sharing.

service level agreement (SLA)  A contract between the end user and the service provider that dictates what is expected of both parties.

SFP (small form-factor pluggable) connector  A network connector that is most often used with 1-Gbps fiber-optic networks but can be used with copper cable networks. SFP+ is used with 10-Gbps networks.

shielded twisted pair (STP)  A type of twisted-pair cable with an additional outer covering to protect against outside interference.

Simple Mail Transfer Protocol (SMTP)  An Internet standard for e-mail transmission between servers; uses TCP port 25 or 465 if secured with SSL or TLS.

Simple Network Management Protocol (SNMP)  A protocol for collecting and analyzing information about devices and configuring this information to affect the devices’ behaviors over a network. SNMP management tools can access MIBs on devices over UDP port 161. An SNMP agent must be running on network devices.

single data rate (SDR) memory  A computer bus that transfers data only once every clock cycle.

single-mode fiber (SMF)  Optical fiber designed to transmit light over long distances.

Single Sign-On (SSO)  An authentication process that enables a user to enter a single username/password combination to access multiple applications.

small form factor (SFF)  A computer form factor designed to reduce the size of a desktop computer; also a smaller hard disk size (2-1/2 inches) than a large form factor (3-1/2 inches) disk. See also large form factor (LFF).

snapshot  See checkpoint.

Software as a Service (SaaS)  A software licensing and delivery model in which the software is hosted at a central location and provided on a subscription basis.

solid-state drive (SSD)  A storage device that stores data in flash memory, as opposed to storing data on magnetic rotating disk platters.

solid-state hybrid drive (SSHD)  A combination of hard disk and solid-state technology in the same package.

southbridge  The second chip of the chipset on a computer motherboard. It generally handles buses or interfaces that do not need direct access to the CPU or that do not need much bandwidth, such as PCI.

ST (straight tip) connector  A fiber-optic connector that is rounded and elongated and commonly used with multi-mode fiber (MMF).

start of authority (SOA)  A type of DNS record that contains information about a DNS zone such as the serial number, zone refresh interval, and so on.

static random access memory (SRAM)  A type of volatile memory. Unlike DRAM, the information in memory does not need to be constantly refreshed. It is both faster and more expensive than DRAM and is typically used for CPU cache.

storage area network (SAN)  A network that provides access to block-level data storage as opposed to servers having their own dedicated local storage.

storage tier  Two or more types of storage that are differentiated by various attributes such as frequency of access. Frequently accessed data is often stored on faster media.

straight-through cable  The type of cable with the RJ-45 connectors at each end having the same pinout; normally used to connect computing devices to network switches.

subnet mask  A mask that is used to determine what subnet an IP address is from. When compared against an IP address, it separates the network portion of the IP address from the host portion. The mask can be expressed in decimal, such as 255.255.0.0, or in CIDR format, such as /16.

SuperDLT  A standard for tape backup media that supports larger capacities and transfer rates than DLT. See also Digital Linear Tape (DLT).

symmetric multiprocessing (SMP)  An architecture in which two or more identical physical processors with centralized memory operate under a single operating system. The motherboard must have multiple CPU sockets.

synchronous replication  Occurs when data is written to a primary location and another location without delay.

Telnet  A protocol used to access a computer system remotely. Its only form of security is a password that is sent in clear text over the network. Telnet listens on TCP port 23.

terabyte (TB)  A unit of digital information equivalent to 1 million million (10¹²) bytes, or 1000 gigabytes.

Teredo  A technology that enables IPv6 traffic to pass over the IPv4 Internet through NAT. The Teredo server must reside on the IPv4 Internet. Public Teredo servers and relays are available.

Terminal Access Controller Access-Control System (TACACS)  A protocol that enables a remote access server to forward a user password to an authentication server.

thin provisioning  A technology that enables storage to be configured without knowing the size required. Disk volumes grow over time as needed.

time-domain reflectometer (TDR)  A device that determines the quality of metallic cables by observing reflected waveforms.

top-level domain (TLD)  A domain at the highest level of the domain name system of the Internet, such as .com or .uk.

tower server  A computer intended to be a server in an upright case that can stand alone.

transfer rate  The speed at which data can be transmitted from one device to another. Usually measured in megabits per second (Mbps) or gigabits per second (Gbps).

Transmission Control Protocol (TCP)  A TCP/IP suite transport protocol that establishes a connection between two hosts before transmitting. TCP requires an acknowledgment from the recipient for every sent packet.

Transmission Control Protocol/Internet Protocol (TCP/IP)  A suite of protocols that map to different layers of the OSI model.

Transport Layer Security (TLS)  A cryptographic protocol that provides secure communications over a computer network. TLS supersedes SSL.

Trivial File Transfer Protocol (TFTP)  A simple version of FTP, used when user authentication is not required, such as with PXE boot.

Trusted Platform Module (TPM)  A firmware standard for a secure cryptoprocessor that is used to secure hardware by integrating cryptographic keys into devices.

unicast  Communication on a network between a single sender and a single receiver.

unified extensible firmware interface (UEFI)  A replacement for the BIOS. A specification that defines an interface between an OS and the platform’s firmware.

uninterruptible power supply (UPS)  A device that provides emergency battery power when an input power source fails. The purpose is not to provide long-term power, but rather to provide enough power to enable equipment to shut down properly.

unit identification (UID)  LED lights on the front and back of a rack-mounted server that blink when the server is being managed remotely or when the UID button is physically pressed on a server. This is useful when technicians must access the back of a rack-mounted server and want to ensure that they are working on the correct server.

universal serial bus (USB)  A standard serial bus that is used as a connector between computer peripherals and computers.

universally unique identifier (UUID)  A unique 128-bit firmware identifier used for asset tracking.

UNIX  A family of multitasking, multiuser operating systems derived from the original AT&T Unix.

unshielded twisted pair (UTP)  A type of twisted-pair cable that has no additional protection or shielding against outside interference.

User Account Control (UAC)  A security feature in versions of Windows from Vista onward. When a program requires administrative privileges, a prompt appears asking whether the user does or does not agree to give the program administrative privileges; this prevents scripts and programs from executing without user consent.

User Datagram Protocol (UDP)  An alternate transport protocol to TCP that is used for establishing low-latency and loss-tolerant connections, such as online video gaming. Unlike TCP, there is no session establishment or acknowledgment of sent packets.

virtual CPU (vCPU)  A physical CPU that is assigned to a virtual machine.

virtual hard disk (VHD)  A file format that contains the disk partitions and file system of a virtual machine.

virtual local area network (VLAN)  A broadcast domain that is isolated at the data link layer. VLANs are configured within switches and are used to create multiple networks for the purposes of security or network performance.

virtual network interface card (vNIC)  A NIC used by a virtual machine as its network interface.

virtual private network (VPN)  A private network that extends over a public network or the Internet using an encrypted tunnel.

virtual server  A server operating system running within a virtual machine on a hypervisor.

virtualization  The ability to create a virtual version of something, such as an operating system, hard disk, or application.

Voice over IP (VoIP)  A group of technologies used to deliver voice communications and multimedia sessions over IP networks.

volt-ampere (VA)  The “apparent power” that is the product of the voltage applied to the equipment multiplied by the current drawn by the equipment.

Wake-on-LAN (WoL)  A standard that enables a computer to be turned on over a network when it receives a specially formed packet.

warm site  An alternate site that is stocked with hardware that can run business operations in the event of a disaster at the original site. To be fully functional, a warm site needs the last backups of the original site, along with personnel.

Wi-Fi  A technology that enables computing devices to connect wirelessly using the IEEE 802.11 standard.

Wi-Fi Protected Access (WPA)  A security protocol used to secure IEEE 802.11 networks. There are two versions: WPA and WPA2. They are the successors of Wired Equivalent Privacy (WEP).

Windows  A line of client operating systems developed and supported by Microsoft.

Windows Imaging Format (WIM)  A file-based disk imaging format developed by Microsoft to help deploy versions of Windows from Vista onward.

Windows Internet Name Service (WINS)  An implementation of the NetBIOS Name Service by Microsoft that enables computers to map hostnames to IP addresses using a centralized service.

Windows Server Update Services (WSUS)  A program developed by Microsoft that enables administrators to deploy updates selectively to computers in a corporate environment.

Windows System Image Manager (Windows SIM)  A tool included with the Windows Assessment and Deployment Kit that aids in creating unattended installation answer files to automate OS deployment.

Wired Equivalent Privacy (WEP)  A security algorithm for IEEE 802.11 wireless networks that is superseded by WPA and WPA2, which provide better security.

World Wide Name (WWN)  A unique identifier used in Fibre Channel, ATA, and SAS, as well as other storage technologies.

Write Once Read Many (WORM)  A data storage device that can be written to only once.

X.509  A standard that specifies formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm.

XFS  A 64-bit journaling file system created by Silicon Graphics, Inc. (SGI) and used in Linux.

zero-day  A vulnerability in a program that is unknown to the vendor.

ZFS  A file system and logical volume manager developed by Sun Microsystems and used by Solaris, OpenSolaris, and FreeBSD, among others.

zombie net  See botnet.

zone transfer  The process of DNS servers replicating DNS zone records using TCP port 53. Microsoft Active Directory–integrated zones replicate with Active Directory and do not use zone transfers.

INDEX

A

A resource records, 78

AAAA resource records, 78

AC (alternating current), 47

access control

authentication. See authentication

description, 12

access control lists (ACLs)

file and print servers, 117

NTFS permissions, 82, 232

restoring, 302–303

access control vestibules, 222

ACK packets

DHCP, 198

TCP, 199

ACLs (access control lists)

file and print servers, 117

NTFS permissions, 82, 232

restoring, 302–303

active/active clustered services, 326

active/active data copies, 332

Active Directory (AD), 79–80

groups, 229–230

server installation, 113

user accounts, 225

Active Directory Domain Services (AD DS) environment, 9, 76

Active Directory Federation Services (ADFS), 225

active/passive clustered services, 326

administration methods, 94

in-band remote administration, 96–100

KVM, 95

out-of-band remote administration, 95–96

review, 118

scripting, 99–100

Advanced Intelligent Tape (AIT), 340–341

Advanced RISC Machine (ARM) processors, 36

air flow, 5–6, 51

aisles, hot and cold, 51

AIT (Advanced Intelligent Tape), 340–341

Alibaba Cloud, 16

alternate sites in disaster recovery, 325–329

alternating current (AC), 47

Amazon Web Services (AWS)

CloudFormation templates, 92

community clouds, 17

CSPs, 16

S3, 10

Amazon Web Services (AWS) Storage Gateway, 328–329, 341

AMD Virtualization (AMD-V) processors, 36

antimalware products, 300

Anything as a Service (XaaS), 17

APIPA (Automatic Private IP Addressing), 75

applications

hardening, 251–252

servers, 81–82

archive bits, 337–338

archives in data replication, 330

ARM (Advanced RISC Machine) processors, 36

ARPANET, 188

assets

business impact analysis, 349

inventory, 101–102

life cycle, 101

asymmetric encryption, 252

asynchronous replication, 329

authentication

description, 12

identity, 224–228

IPSec, 246–247

KVM, 96

overview, 224

RADIUS, 237–238

RDP, 98

review, 264

SSH, 97

TACACS, 238

VPNs, 248

web servers, 81

Automatic Private IP Addressing (APIPA), 75

automating administration, 99–100

availability, troubleshooting, 293

AWS. See Amazon Web Services (AWS)

Azure cloud

backups, 342

charges, 90

logs, 279

NSGs, 242

templates, 71–72

Azure Information Protection (AIP), 253

Azure Resource Manager (ARM), 92

B

backplanes for blade servers, 33

backups, 335–336

best practices, 343–344

cloud, 342–343

media, 340–341

on-premises, 341–342

review, 350–351

troubleshooting, 293

types, 336–340

bare-metal backups, 339–340

bare-metal hypervisors, 86

bare-metal installations, 91

bare-metal server restoration, 328

base 2 vs. base 10 storage, 144

Bash scripts, 100

basic disks, 148

basic input-output system (BIOS)

overview, 34–35

troubleshooting, 286

WoL support, 183

batch scripts, 100

batteries

CMOS, 292

direct current, 47

RAID, 44, 148

UPSs, 48–50

BCPs (business continuity plans), 334–335, 349–350

BetCRIS attacks, 243

BIA (business impact analysis), 325, 332–333

biometric authentication, 227–228

BIOS (basic input-output system)

overview, 34–35

troubleshooting, 286

WoL support, 183

BitLocker encryption, 254–255

black holing traffic, 243

blade servers, 32–33

Blue Screen of Death (BSoD), 287

boot sequence, 286

broad network access in cloud computing, 15

buses

CPUs, 37

description, 4

disk systems, 135

overview, 40–41

PCI, 41–43

business continuity and business continuity plans (BCPs), 334–335, 349–350

business impact analysis (BIA), 325, 332–333

bytes, 188

C

cable

description, 7

labeling, 176

placement, 175–176

review, 207

types, 177–181

cable management arms for racks, 31

caches in CPUs, 37–38

cameras, 222

camouflage, 222

capacity, storage, 143–144

capital expenditures (CAPEX), 16

card-based access, 222–223

CAs (certificate authorities), 244–245

Catx copper cable categories, 179–180

CDP (continuous data protection) replication, 328

central processing units (CPUs)

architecture, 36

buses, 37

caches, 37–38

description, 3

hypervisors, 88

licensing, 90

scaling up, 36

troubleshooting, 286

certificate authorities (CAs), 244–245

certificates in PKI, 224, 244–245

ciphers, 304

CISC (Complex Instruction Set Computing) processors, 3, 38

claims in tokens, 225

clean-agent fire suppression systems, 52

cloning, 92

cloud computing

backups, 342–343

characteristics, 15

deployment models, 16–17

printing, 83

service models, 17

storage, 139

cloud service providers (CSPs), 16

CloudFormation templates, 92

clustered services, 326

CMOS (complementary metal oxide semiconductor)

batteries, 292

BIOS, 34–35

CNAME resource records, 78

CNAs (converged network adapters), 142

cold aisles, 51

cold sites, 328

cold spares, 154

colons (:) in IPv6 addresses, 193

community clouds, 17

CompactFlash storage, 135

complementary metal oxide semiconductor (CMOS)

batteries, 292

BIOS, 34–35

Complex Instruction Set Computing (CISC) processors, 3, 38

compression, disk, 146–147

confidentiality, encryption for, 304–305

connectivity troubleshooting, 297

connectors

copper cables, 178

description, 7

fiber-optic cables, 181

review, 207

Continuity Of Operations (COOP), 335

continuous data protection (CDP) replication, 328

converged network adapters (CNAs), 142

copper cables, 177–178

CPUs. See central processing units (CPUs)

crash carts, 285

crossover cables, 178

CSPs (cloud service providers), 16

customer replaceable units (CRUs), 48

D

DaaS (Desktop as a Service), 39

DAC (Dynamic Access Control), 229–230

DACLs (discretionary access control lists), 232–233

DAS (direct-attached storage), 43, 139

data at rest

description, 12–13

encrypting, 253–256

Data Collector Sets (DCSs), 290

data deduplication, 147

data loss prevention (DLP) tools, 253

data replication

archives, 330

disk-to-disk, 329–330

review, 348

server-to-server, 331–332

site-to-site, 332

data security, 252

data at rest, 253–256

media disposal, 257–259

review, 266

tape encryption, 256

DC (direct current), 47

DCSs (Data Collector Sets), 290

dd command, 330

DDoS (distributed denial-of-service) attacks, 242–243

DDR (double data rate) memory, 4, 40–41

deduplication of data, 147

deep packet inspection (DPI), 241–242

default gateways, 195–196

degaussing media, 258

Delisle, Jeffrey, 224

demilitarized zones (DMZs), 243–244

deployment

cloud computing models, 16–17

virtual machine templates, 92–93

Deployment Image Servicing and Management (DISM.exe) tool, 148

Desired State Configuration (DSC), 11

Desktop as a Service (DaaS), 39

df tool, 291, 294–295

DFSR (Distributed File System Replication), 331

DHCP. See Dynamic Host Configuration Protocol (DHCP)

differential backups, 337

Digital Linear Tape (DLT) standard, 340–341

direct-attached storage (DAS), 43, 139

direct current (DC), 47

direct memory access (DMA), 42

directory services (DSs)

Active Directory, 79–80

objects, 79

review, 117

disaster recovery (DR), 325

alternate sites, 325–329

business continuity, 334–335

business impact analysis, 332–333

data backups, 335–344

data replication, 329–332

hands-on exercises, 344–348

questions, 351–359

review, 348–351

sites, 347–348

disaster recovery plans (DRPs)

overview, 334–335

review, 349

discontinuous transmission (DTX), 285

Discover packets in DHCP, 197

discretionary access control lists (DACLs), 232–233

disk-to-disk data replication, 329–330

disks and disk drives

compression, 146–147

DAS, 139–142

data deduplication, 147

data replication, 329–330

disposal, 266

hybrid, 136

I/O optimization, 306

image files, 147–148

interfaces, 137–138

magnetic, 134

optical, 138–139

quotas, 145–146

RAID. See Redundant Array of Independent Disks (RAID)

review, 161

scrubbing, 257

space consumers, 144–145

SSDs, 134–135

troubleshooting, 288

DISM.exe (Deployment Image Servicing and Management) tool, 148

disposal of media, 257–259, 266

distributed denial-of-service (DDoS) attacks, 242–243

Distributed File System Replication (DFSR), 331

DLP (data loss prevention) tools, 253

DLT (Digital Linear Tape) standard, 340–341

DMA (direct memory access), 42

DMZs (demilitarized zones), 243–244

DNS. See Domain Name Service (DNS)

documentation

asset inventory, 101–102

asset life cycle, 101

factors, 104–105

hardware inventory, 102–103

importance, 100–101

problem solution, 284

reading, 281–282

review, 118–119

service level agreements, 104

software inventory, 103

Domain Name Service (DNS), 75–76

configuring, 112

description, 200–201

domains, 76–77, 197

hierarchy, 197

installing, 110–111

logs, 279–280

overview, 196

resource records, 77–78

review, 116

troubleshooting, 298–299

domains in DNS, 76–77, 197

doors, 222

double data rate (DDR) memory, 4, 40–41

double pumping memory, 39

DPI (deep packet inspection), 241–242

DRAM (dynamic memory)

caches, 37

description, 4

drives. See disks and disk drives

DRPs (disaster recovery plans)

overview, 334–335

review, 349

DSC (Desired State Configuration), 11

DTX (discontinuous transmission), 285

duplexing disks, 148

Dynamic Access Control (DAC), 229–230

dynamic disks, 148

dynamic groups, 229

Dynamic Host Configuration Protocol (DHCP)

description, 201

operation, 197–198

overview, 72–73

PXE operating system installation, 183

review, 116

scope, 73–74

server installation, 114

vendor classes, 73–75

dynamic memory (DRAM)

caches, 37

description, 4

E

ECC (error correcting code) memory, 4, 39–40

EFS (Encrypting File System), 254–255, 261

elasticity in cloud computing, 15

electrostatic discharge (ESD), 5, 47–48

enclosures for blade servers, 32–33

Encrypting File System (EFS), 254–255, 261

encryption

BitLocker, 254–255

for confidentiality and integrity, 304–305

data at rest, 253–256

data security, 253

EFS, 254–255, 261

IIS web server, 262–263

OpenSSL, 261–262

tape, 256

environment, 286

controls, 50–52, 57

fire suppression, 6

heat and air flow, 5

static charges, 5

error correcting code (ECC) memory, 4, 39–40

eSATA (external SATA) disk interface, 138

escalating problems, 283

ESD (electrostatic discharge), 5, 47–48

F

fabric switches, 142

FAST (fully automated storage tiering) feature, 136

fiber-optic cables, 180–181

Fibre Channel (FC) interface, 138

Fibre Channel over Ethernet (FCoE) interface, 142

File Transfer Protocol (FTP), 200

File Transfer Protocol Secure (FTPS), 200

files and file systems

access issues, 293

overview, 153–155

permissions, 231–235

restoring, 345–346

review, 162

servers, 82

fire suppression, 6, 51–52

firewalls, 239–240

host-based, 240

Linux, 241

network-based, 241–243

review, 265

rules, 262

Windows Firewall, 240–241

firmware

BIOS, 34–35

description, 33

firewalls, 240

hypervisors, 90

TPM, 254

UEFI, 35

updates, 105

flooding attacks

DDoS, 243

MAC, 239

folder permissions, 233, 260

form factors

blade servers, 32–33

description, 3

hard disks, 134

overview, 27–28

rack-mounted equipment, 29–31

review, 56

tower servers, 28–29

forward lookups in DNS servers, 76, 196

FQDNs (fully qualified domain names), 75–76

fsck tool, 294

FTP (File Transfer Protocol), 200

FTPS (File Transfer Protocol Secure), 200

full backups, 337

fully automated storage tiering (FAST) feature, 136

fully qualified domain names (FQDNs), 75–76

future growth for storage, 143–144

G

gateways, default, 195–196

GCP (Google Cloud Platform), 16

geofencing, 253

get-volume cmdlet, 291

getfacl command, 302–303

GFS (Grandfather-Father-Son) tape rotation strategy, 343–344

GlobalNames zone in DNS, 77

Google Cloud Platform (GCP), 16

GPOs (Group Policy Objects), 301

gpresult command, 301

GPTs (GUID Partition Tables), 34, 152–153, 294

Grandfather-Father-Son (GFS) tape rotation strategy, 343–344

graphics processing units (GPUs), 38–39

Group Policy, 301

Group Policy Objects (GPOs), 301

groups in logical access control, 229

guards, 222

guest configuration for virtual machines, 87–89

GUID Partition Tables (GPTs), 34, 152–153, 294

H

halon fire suppression systems, 52

hard disk drives (HDDs). See disks and disk drives

hard quotas for disks, 145

hardening, 249

applications, 251–252

hardware, 251

operating systems, 250–251

overview, 11

review, 266

hardware, 2–3

BIOS, 34–35

buses, 4, 40–43

CPUs, 3, 36–38

environmental controls, 50–52

environmental factors, 5–6

form factors, 3, 27–33

GPUs, 38–39

hands-on exercises, 53–55

hardening, 251

inventory, 102–103

memory, 3–4, 39–40

network communications, 182–186

NICs, 43

optimizing, 306

power, 46–50

questions, 57–69

review, 56–57

server components, 33

slots, 4

storage, 43–44

troubleshooting, 13, 285–286, 311

UEFI, 35

USB, 44–46

virtualization, 4–5

Hardware Compatibility List (HCL), 285

hashing, 304

HDDs (hard disk drives). See disks and disk drives

Health Insurance Portability and Accountability Act (HIPAA), 254

heat issues, 5–6

HIDs (human interface devices), 45

HIDSs (host intrusion detection systems), 248

hierarchical storage management (HSM), 136

hierarchy in DNS, 197

HIPAA (Health Insurance Portability and Accountability Act), 254

hit rate for caches, 37

hopping in VLAN, 239

horizontal scaling, 307

host-based firewalls, 240

host configuration for hypervisors, 86–87

host intrusion detection systems (HIDSs), 248

host-to-host replication, 331

HOSTS file, 298

hot aisles, 51

hot sites, 327–328

hot spares, 44, 154

hot-swapping, 44

HSM (hierarchical storage management), 136

HTTP (Hyper Text Transfer Protocol)

description, 200

traffic analysis, 205–206

web servers, 80–81

HTTPS (Hyper Text Transfer Protocol Secure), 200

human element in physical security, 223–224

human interface devices (HIDs), 45

humidity controls, 51

hybrid clouds, 17

hybrid drives, 136

Hyper Text Transfer Protocol (HTTP)

description, 200

traffic analysis, 205–206

web servers, 80–81

Hyper Text Transfer Protocol Secure (HTTPS), 200

hypervisors

hardware, 88

host configuration, 86–87

installing, 90–91

types, 85–87

I

IaaS (Infrastructure as a Service), 17

icacls command, 302–303

identifying problems, 278

identity federation

authentication, 224–225

web servers, 81

IDFs (intermediary distribution frames), 29

iDRAC (Integrated Dell Remote Access), 96

IIS web server, encrypting, 262–263

iLO (Integrated Lights Out) management, 96

images

server installation from, 91–92

Windows, 147–148

IMAP (Internet Message Access Protocol)

description, 200

mail servers, 83

in-band remote administration, 96–100

incremental backups, 338

Infrastructure as a Service (IaaS), 17

infrastructure roles

APIPA, 75

DHCP, 72–75

directory services, 79–80

DNS, 75–77

NTP, 77–79

WINS, 77

infrastructure services in network communications, 195–201

Initialize-Disk cmdlet, 294

initiators in iSCSI, 141, 157–158

input/output operations per second (IOPS), 135, 289

installation, 89

Active Directory Server, 114

DHCP servers, 114

DNS servers, 110–111

hypervisors, 90–91

licensing, 90

operating systems, 91–92, 106–110

review, 117–118

storage devices, 152–156

Ubuntu Linux, 114–116

instances, 3

Integrated Dell Remote Access (iDRAC), 96

Integrated Lights Out (iLO) management, 96

integrity, encryption for, 304–305

Intel Virtualization Technology (Intel VT), 36

Intelligent Platform Management Interface (IPMI), 96

interfaces, disk, 137–138

intermediary CAs, 245

intermediary distribution frames (IDFs), 29

internal IPv4 addresses, 189–190

Internet connectivity issues, 297

Internet Message Access Protocol (IMAP)

description, 200

mail servers, 83

Internet Protocol (IP)

addresses. See IPv4 addresses; IPv6 addresses

description, 7

importance, 188

review, 208

Internet Protocol Security (IPSec)

overview, 246–248

review, 265

Internet Small Computer System Interface (iSCSI)

overview, 140–141

target installation, 156–158

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), 195

intranets, 243

intrusion prevention systems (IPSs)

description, 249

review, 266

inventory

assets, 101–102

hardware, 102–103

software, 103

IOPS (input/output operations per second), 135, 289

iostat tool, 294

IP. See Internet Protocol (IP)

IPMI (Intelligent Platform Management Interface), 96

IPSec (Internet Protocol Security)

overview, 246–248

review, 265

IPSs (intrusion prevention systems)

description, 249

review, 266

iptables for firewalls, 262

IPv4 addresses, 187

configuring, 108–109, 203–204

PAT, 187–188

reserved ranges, 189–190

review, 208

routers, 186

static NAT, 188

subnet masks, 189

subnetting, 190–193

troubleshooting, 298

IPv6 addresses, 193–194

configuring, 202–204

review, 208

settings, 194–195

transition technologies, 195

troubleshooting, 298

ISATAP (Intra-Site Automatic Tunnel Addressing Protocol), 195

iSCSI (Internet Small Computer System Interface)

overview, 140–141

target installation, 156–158

J

jacks for cable, 176

journaled file systems, 154

just a bunch of disks (JBOD), 148

K

Key Management Service (KMS) servers, 90

keyboard, video, mouse (KVM) switches, 95

kill tool, 291

KVM over IP, 96

L

L1, L2, and L3 caches, 37

L2TP/IPSec (Layer 2 Tunneling Protocol with IPSec), 248

labeling cable, 176

LANs (local area networks)

connectivity issues, 297

VLANs, 184, 238–239

large form factor (LFF) hard drives, 134

latency in disk systems, 135

Layer 2 and Layer 3 Switches, 184–185

Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), 248

layers in OSI model, 173–175

LC (local connector) fiber-optic cables, 181

LDAP (Lightweight Directory Access Protocol)

description, 200

directory services, 79

LFF (large form factor) hard drives, 134

licensing servers, 90

life cycle of assets, 101

lights-out management (LOM), 95–96

Lightweight Directory Access Protocol (LDAP)

description, 200

directory services, 79

linear access tape for backups, 341

Linear Tape-Open (LTO) standard, 340–341

link-local addresses, 193

Linux operating system

ACLs, 303

data replication, 330

file systems, 154

firewalls, 241

logs, 279–280, 310

performance monitoring tools, 309

permissions, 234–235, 260–261, 301–302

privileges, 302

storage troubleshooting tools, 294–295

Ubuntu Linux, 114–116

live failover, 326

LMHOSTS file, 77

local area networks (LANs)

connectivity issues, 297

VLANs, 184, 238–239

local connector (LC) fiber-optic cables, 181

Local Group Policy, 301

local operating system installation, 93–94

locks, 222, 228

logical access control, 228

DAC, 229–230

groups, 229

peripheral devices, 235–237

review, 264

rights and permissions, 231–236

roles, 231

Logical Volume Management (LVM), 153

login failures, 287

logs

Linux, 310

PowerShell, 309

troubleshooting, 288

types, 279–281

LOM (lights-out management), 95–96

lsof tool, 294

LTO (Linear Tape-Open) standard, 340–341

LVM (Logical Volume Management), 153

M

MAC (mandatory access control), 232–233

MAC (Media Access Control) addresses

flooding attacks, 239

NICs, 182

magnetic hard disks, 134

mail servers, 83–84

main distribution frames (MDFs), 29

maintenance

overview, 9–10

patch management, 105

proactive, 106

reactive, 106

review, 119

malware

troubleshooting, 299–300

USB devices, 235–236

mandatory access control (MAC), 232–233

mantraps, 222

masks, subnet, 189

master boot record (MBR), 34, 152–153, 294

mdadm tool, 294

MDFs (main distribution frames), 29

MDM (mobile device management)

mail server tools, 84

remote wipes, 258–259

MDT (Microsoft Deployment Toolkit), 148

mean time between failures (MTBF), 335

mean time to repair (MTTR), 335

measured service in cloud computing, 15–16

media

backups, 340–341

disposal, 257–259, 266

Media Access Control (MAC) addresses

flooding attacks, 239

NICs, 182

memory

DDR, 40

ECC, 39–40

hypervisors, 88

leaks, 287

overview, 3–4

timing, 39

troubleshooting, 286–287

MFA (multifactor authentication), 227

Microsoft Deployment Toolkit (MDT), 148

Microsoft Management Console (MMC), 94

midplanes for blade servers, 33

MMF (multi-mode fiber), 181

mobile device management (MDM)

mail server tools, 84

remote wipes, 258–259

mobile devices

data security, 253

remote wipes, 258–259

monitoring

description, 10

performance, 307–308

UPSs, 50

most recently used (MRU) path selection policy, 326

MTBF (mean time between failures), 335

MTTR (mean time to repair), 335

multi-mode fiber (MMF), 181

multifactor authentication (MFA), 227

multihomed servers, 84

MX resource records, 78

N

NAC (Network Access Control), 237–238

name resolution. See Domain Name Service (DNS)

naming servers, 109

NAS (network-attached storage), 43, 140

NAT. See network address translation (NAT)

National Institute of Standards and Technology (NIST)

cloud computing, 15

security guides, 249

near-field communication (NFC), 223

netstat command, 199, 298

Network Access Control (NAC), 237–238

network adapters, adding, 108

network address translation (NAT)

configuring, 204–205

internal hosts, 208

RRAS, 84–85

static, 188

VM setting, 87

network-attached storage (NAS), 43, 140

network-based firewalls, 241–243

network communications, 173

cable labeling, 176

cable placement, 175–176

cable types, 177–181

default gateways, 195–196

DHCP, 197–198

DNS servers, 196–197

hands-on exercises, 202–206

hardware, 182–186

infrastructure services, 195–201

IPv4, 187–193

IPv6, 193–195

NICs, 182–184

OSI model, 173–175

questions, 208–219

review, 207–208

routers, 186

switches, 184–185

TCP, 198–200

UDP, 199, 201

WINS servers, 197

network concepts, 7–8

Network File System (NFS)

file servers, 82

shared files, 140, 155

network interface cards (NICs), 182

common features, 182–184

description, 43

MAC addresses, 182

review, 207

network intrusion detection systems (NIDSs), 249

Network Level Authentication (NLA), 98

network load balancing (NLB), 307

network security, 237

firewalls, 239–243

intrusion detection and prevention systems, 248–249

IPSec, 246–248

NAC, 237–238

PKI, 244–245

RADIUS, 237–238

review, 264

security zones, 243–244

SSL and TLS, 246

VLANs, 238–239

VPNs, 248

Network Security Groups (NSGs), 242

Network Time Protocol (NTP)

description, 201

review, 116

tiers, 78–79

time synchronization, 77–78

networks

hypervisors, 88

optimizing, 306–307

security, 11

troubleshooting, 14, 296–299, 312

new-psdrive cmdlet, 291

New Technology File System (NTFS)

description, 153–154

permissions, 231–233, 259–260

NFC (near-field communication), 223

NFS (Network File System)

file servers, 82

shared files, 140, 155

NICs. See network interface cards (NICs)

NIDSs (network intrusion detection systems), 249

NIST (National Institute of Standards and Technology)

cloud computing, 15

security guides, 249

NLA (Network Level Authentication), 98

NLB (network load balancing), 307

node-locked licenses, 90

NSGs (Network Security Groups), 242

nslookup command, 298–299

NTFS (New Technology File System)

description, 153–154

permissions, 231–233, 259–260

NTP. See Network Time Protocol (NTP)

O

octets in IP addresses, 188

Offer packets in DHCP, 197

on-demand self-service in cloud computing, 15

on-premises backups, 341–342

one-time passwords (OTPs), 227

Open Shortest Path First (OSPF) protocol, 186

open-source licensing, 90

Open Systems Interconnection (OSI) model

layers, 173–175

review, 207

OpenSSL, 255–256, 261–262

operating systems

hardening, 250–251

installing, 91–94, 106–110, 114–116

overview, 8–10

troubleshooting, 288–289

optical drives, 138–139

optical time-domain reflectometers (OTDRs), 296

optimizing performance, 13, 305–307, 313

OSI (Open Systems Interconnection) model

layers, 173–175

review, 207

OSPF (Open Shortest Path First) protocol, 186

OTDRs (optical time-domain reflectometers), 296

OTPs (one-time passwords), 227

out-of-band remote administration, 95–96

P

P2V (physical-to-virtual) cloning, 92

PaaS (Platform as a Service), 17

packet flooding, 243

PAT (Port Address Translation), 187–188

patches

managing, 105

troubleshooting, 288

Payment Card Industry Data Security Standard (PCI-DSS), 254

PBX (private branch exchange) devices, 178

PCI Express (PCIe) bus, 42–43

PCI Extended (PCI-X) bus, 42

PCI (Peripheral Component Interconnect) bus, 41–43

per-user concurrent licensing, 90

performance

Linux tools, 309

optimizing, 13, 305–307, 313

troubleshooting, 288

Windows tools, 307–308

Performance Monitor tool, 305–306

perimeter firewalls, 241

Peripheral Component Interconnect (PCI) bus, 41–43

peripheral devices

printers, 235

projectors, 235

USB, 235–237

permissions, 231–235

Linux, 234–235, 260–261

NTFS, 231–233, 259–260

shared folders, 232–233, 260

troubleshooting, 301–303

personally identifiable information (PII), 254

physical destruction of media, 257

physical security, 221

authentication, 224–228

human element, 223–224

locks, 228

premises, 221–223

review, 264

physical-to-virtual (P2V) cloning, 92

PII (personally identifiable information), 254

PKI. See Public Key Infrastructure (PKI)

plans

BCPs, 334–335, 349–350

DRPs, 334–335, 349

problem solving, 282

Platform as a Service (PaaS), 17

Point-to-Point Tunneling Protocol (PPTP), 248

POP (Post Office Protocol)

description, 200

mail servers, 83

Port Address Translation (PAT), 187–188

ports

overview, 7–8

TCP, 199

Post Office Protocol (POP)

description, 200

mail servers, 83

POST (power on self test)

description, 34

troubleshooting, 286

power, 46

electrostatic discharge, 47–48

review, 57

troubleshooting, 286

UPSs, 48–50

usage calculations, 49–50

USB device requirements, 45–46

voltage, 46–47

wattage, 48

power on self test (POST)

description, 34

troubleshooting, 286

PowerShell

Active Directory, 80

folder sharing, 82

logs, 309

printer sharing, 83

remote administration, 98–100

PPTP (Point-to-Point Tunneling Protocol), 248

Preboot Execution Environment (PXE)

booting from, 93–94, 117

malware removal, 300

NICs, 183

warm sites, 328

premises security, 221–223

printers and printing

access control, 235

servers, 83

troubleshooting, 289

private branch exchange (PBX) devices, 178

private clouds, 16

proactive maintenance, 106

probe generators, 296

processors. See central processing units (CPUs)

projectors, 235

protocols overview, 7–8

proxy servers, reverse, 241, 265

ps tool, 291

PSoD (Purple Screen of Death), 288

PTR resource records, 78

public clouds, 16

Public Key Infrastructure (PKI), 244

authentication, 224

certificates, 244–245

description, 12

review, 265

Purple Screen of Death (PSoD), 288

PXE. See Preboot Execution Environment (PXE)

Q

quotas, disk, 145–146

R

rack-mounted equipment

cable management arms, 31

racks, 30–31

servers, 29–30

space calculations, 53

radiofrequency identification (RFID) chips, 222–223

RADIUS (Remote Authentication Dial-In User Service), 237–238

RAID. See Redundant Array of Independent Disks (RAID)

random access memory (RAM), 39

ransomware, 236–237

rapid elasticity in cloud computing, 15

RAs (registration authorities), 244

RBAC (role-based access control), 231

RDP (Remote Desktop Protocol), 98, 200

reactive maintenance, 106

recovery point objective (RPO), 333, 335, 349

recovery points, 340

recovery time objective (RTO), 325, 327–329, 332–334, 349

Reduced Instruction Set Computing (RISC) processors, 3, 37

Redundant Array of Independent Disks (RAID)

configuring, 148–149, 158–160

controllers, 43–44

description, 6

levels, 149–152

review, 161

ReFS (Resilient File System), 153–154

registration authorities (RAs), 244

Reliability Monitor history, 280–281

remote administration

in-band, 96–100

out-of-band, 95–96

Remote Authentication Dial-In User Service (RADIUS), 237–238

Remote Desktop Protocol (RDP), 98, 200

Remote Installation Services (RIS), 93

Remote Server Administration Tools (RSAT), 94–95

remote wipes, 258–259

removal of malware, 300

Repair-Volume cmdlet, 294

repeaters, 179

replication. See data replication

reproducing problems, 278–279

Request packets in DHCP, 198

reserved IP address ranges, 189–190

Resilient File System (ReFS), 153–154

resizing memory, 3–4

resource pooling in cloud computing, 15

resource records in DNS, 77–78

restores

ACLs, 302–303

best practices, 343–344

files, 345–346

reverse lookups in DNS servers, 76, 196

reverse proxy servers, 241, 265

revolutions per minute (RPMs) in disk systems, 135

RFID (radiofrequency identification) chips, 222–223

rights, 231

RIP (Routing Information Protocol), 186

RIS (Remote Installation Services), 93

RISC (Reduced Instruction Set Computing) processors, 3, 37

role-based access control (RBAC), 231

roles

administration methods, 94–100

application servers, 81–82

documentation, 100–105

file servers, 82

hands-on exercises, 106–116

infrastructure, 72–80

logical access control, 231

mail servers, 83–84

maintenance, 105–106

overview, 8–10, 71–72

print servers, 83

questions, 119–131

review, 116–119

routing and remote access service, 84–85

server installation, 89–94

virtualization servers, 85–89

web servers, 80–81

rollover cables, 179

root cause analysis, 283–284

rotational latency in disk systems, 135

route command, 298

routers, 186

routing and remote access service (RRAS), 84–85

Routing Information Protocol (RIP), 186

RPMs (revolutions per minute) in disk systems, 135

RPO (recovery point objective), 333, 335, 349

RRAS (routing and remote access service), 84–85

RSAT (Remote Server Administration Tools), 94–95

rsync tool, 332

RTO (recovery time objective), 325, 327–329, 332–334, 349

rules for firewalls, 262

S

SaaS (Software as a Service), 17

SANs (storage area networks), 43

backups, 256

overview, 142–143

SAS (serial-attached SCSI) disk interface, 138

SATA (serial ATA) disk interface, 135, 138

SC (subscriber connectors), 181

scaling out CPUs, 36

scaling up CPUs, 36

SCCM (System Center Configuration Manager), 102–103, 148

scope

DHCP, 73–74

problems, 278

SCP (Secure Copy), 200

screened subnets, 243–244

scripting

administration, 99–100

server installations, 93

scrubbing disks, 257

SCSI (Small Computer System Interface), 138

SD (Secure Digital) storage, 135

SDRAM (synchronous DRAM), 37

SECaaS (Security as a Service), 242

Secure Boot, 35

Secure Copy (SCP), 200

Secure Digital (SD) storage, 135

Secure File Transfer Protocol (SFTP), 200

Secure Shell (SSH), 97, 200

Secure Sockets Layer (SSL)

description, 246

VPN tunnels, 248

security, 221

cloud backups, 342–343

considerations, 10

data, 252–259

hands-on exercises, 259–263

hardening, 11, 249–252

logical access control, 228–237

network. See network security

physical, 221–228

questions, 266–276

review, 264–266

troubleshooting, 14, 299–305, 312–313

Security as a Service (SECaaS), 242

Security-Enhanced Linux (SELinux) operating system, 232–233

security guards, 222

security information and event management (SIEM), 249

security zones, 243–244

seek time for disk systems, 135

SELinux (Security-Enhanced Linux) operating system, 232–233

serial ATA (SATA) disk interface, 135, 138

serial-attached SCSI (SAS) disk interface, 138

server components, 33

Server Manager, 80

Server Message Block (SMB) protocol

CIFS, 140

file servers, 82

server overview

cloud computing, 15–17

hardware basics, 2–6

network concepts, 7–8

operating systems and roles, 8–10

optimizing performance, 13

questions, 18–26

review, 18

security considerations, 10–13

storage, 6

troubleshooting, 13–14

server-to-server replication, 331–332

service level agreements (SLAs)

description, 10

documenting, 104

service models in cloud computing, 17

services, troubleshooting, 289

setfacl command, 302

SetUID bit, 302

SFF (small form factor) disks, 134

SFP (small form-factor pluggable) connectors, 181

SFTP (Secure File Transfer Protocol), 200

shared folder permissions, 233, 260

shielded twisted pair (STP) cable, 177–178

side-by-side backups, 336

SIEM (security information and event management), 249

Simple Mail Transfer Protocol (SMTP)

description, 200

mail servers, 83

Simple Network Management Protocol (SNMP)

description, 201

in-band remote administration, 97

single-factor authentication, 225

single-instance storage, 148

single-mode fiber (SMF), 181

Single Sign-On (SSO), 81, 224–225

site-to-site replication, 332

sites for disaster recovery, 325

alternate, 325–327

cold, 328

hot, 327–328

warm, 328–329

6to4 technology for IPv6, 195

sizing virtual servers, 306

SLAs (service level agreements)

description, 10

documenting, 104

slipstreaming, 93

slots, 4

Small Computer System Interface (SCSI), 138

small form-factor pluggable (SFP) connectors, 181

small form factor (SFF) disks, 134

smartcards, 222–223

SMB (Server Message Block) protocol

CIFS, 140

file servers, 82

SMF (single-mode fiber), 181

smoke detectors, 52

SMP (symmetric multiprocessing) CPUs, 37

SMTP (Simple Mail Transfer Protocol)

description, 200

mail servers, 83

snapshots

backups, 338–339

creating, 110

SNMP (Simple Network Management Protocol)

description, 201

in-band remote administration, 97

Snort IDS, 249

SOA resource record, 78

sockets for CPUs, 38

soft disk quotas, 145

software

inventory, 103

optimizing, 306

troubleshooting, 13, 285, 287–291, 311–312

Software as a Service (SaaS), 17

solid-state drives (SSDs), 134–136

solid-state hybrid drives (SSHDs), 136

solutions to problems, 283

something you are authentication factor, 227–228

something you have authentication factor, 226–227

something you know authentication factor, 225–226

speed of CPUs, 36

SRAM (static memory)

caches, 37

description, 4

SRV resource records, 78

SSDs (solid-state drives), 134–136

SSH (Secure Shell), 97, 200

SSHDs (solid-state hybrid drives), 136

SSL (Secure Sockets Layer)

description, 246

VPN tunnels, 248

SSO (Single Sign-On), 81, 224–225

ST (straight-tip) connectors, 181

stateful packet inspection, 241

static charges, 5, 47–48

static memory (SRAM)

caches, 37

description, 4

static NAT, 188

storage, 43

base 2 vs. base 10, 144

capacity and future growth, 143–144

cloud, 139

conserving, 145–148

device installation, 152–156

direct-attached storage, 139

disk interfaces, 137–138

disk space consumers, 144–145

FCoE, 142

hands-on exercises, 156–160

hybrid drives, 136

hypervisors, 88

iSCSI, 140–141, 156–158

magnetic hard disks, 134

network-attached storage, 140

optical drives, 138–139

overview, 6

questions, 162–172

RAID, 43–44, 148–152

review, 160–162

snapshots, 338

solid-state drives, 134–136

storage area networks, 142–143

technologies, 133–134

tiers, 136–137

troubleshooting, 14, 286, 292–295, 312

storage area networks (SANs), 43

backups, 256

overview, 142–143

STP (shielded twisted pair) cable, 177–178

straight-through cable, 178

straight-tip (ST) connectors, 181

stratums in NTP, 78–79

subnets and subnet masks

IPv4 addresses, 189–193

screened, 243–244

subscriber connectors (SC), 181

subscription-based licensing, 90

sudo command, 302

switches

KVM, 95

network, 184–185

symmetric keys for encryption, 253

symmetric multiprocessing (SMP) CPUs, 37

SYN packets, 199

SYN/ACK packets, 199

synchronous DRAM (SDRAM), 37

synchronous replication, 329

System Center Configuration Manager (SCCM), 102–103, 148

T

TACACS (Terminal Access Controller Access-Control System), 238

tailgating, 222

tape

backups, 340–341

encryption, 256

tar command, 330, 347–348

targets in iSCSI, 141, 156–157

TCP. See Transmission Control Protocol (TCP)

TDRs (time-domain reflectometers), 296

teaming, NIC, 43, 183–184

Telnet, 200

temperature controls, 50–51

templates for virtual machine deployment, 92–93

Teredo technology, 195

Terminal Access Controller Access-Control System (TACACS), 238

testing problem theories, 282

TFTP (Trivial FTP), 201

theories for problem causes, 282

thin provisioning, 146

three-way handshakes, 199

tiers

NTP, 78–79

storage, 136–137

time-domain reflectometers (TDRs), 296

timing

memory, 39

NTP. See Network Time Protocol (NTP)

TLS (Transport Layer Security), 246

tokens in authentication, 225, 227

tone generators, 296

top tool, 291

tower servers, 28–29

TPM (Trusted Platform Module), 254

traceroute command, 296

tracert command, 296

transfer rate in disk systems, 135

Transmission Control Protocol (TCP)

common services, 201

overview, 198–199

ports, 8

review, 208

Transport Layer Security (TLS), 246

transport mode for IPSec, 248

Trivial FTP (TFTP), 201

troubleshooting, 13

hands-on exercises, 307–310

hardware, 13, 285–286

methodology, 277–284, 310–311

networks, 14, 296–299

permissions, 301–303

questions, 313–324

review, 310–313

security, 14, 299–305, 312–313

software, 13, 285, 287–291

storage, 14, 286, 292–295

Trusted Platform Module (TPM), 254

tunnel mode in IPSec, 247

Type 1 hypervisors

configuring, 86–87

installing, 90–91

Type 2 hypervisors, 86

U

Ubuntu Linux 20.04.1 operating system, 114–116

UDP (User Datagram Protocol)

description, 199, 201

ports, 8

review, 208

UIDs (unit identifications) for racks, 29

Unified Extensible Firmware Interface (UEFI)

features, 35

WoL support, 183

uninterruptible power supplies (UPSs), 48–50

unit identifications (UIDs) for racks, 29

Universal Serial Bus (USB)

access control, 235–237

disk interface, 138

drives, 135–136

ports, 44–46

Unix operating system

file systems, 154

logs, 279–280

permissions, 234–235

unshielded twisted pair (UTP) cable, 177–178

UPSs (uninterruptible power supplies), 48–50

USB. See Universal Serial Bus (USB)

User Account Control settings, 289–290

User Datagram Protocol (UDP)

description, 199, 201

ports, 8

review, 208

UTP (unshielded twisted pair) cable, 177–178

V

VBS (Visual Basic Script), 100

vCPUs (virtual CPUs), 4–5

vendor classes in DHCP, 73–75

verifying problem solutions, 283

virtual CPUs (vCPUs), 4–5

virtual hard disk (VHD) files, 43

virtual local area networks (VLANs), 184, 238–239

Virtual Machine File System (VMFS), 154

virtual machines

configuration, 53–55

creating, 110

deployment templates, 92–93

guest configuration, 87–89

virtual NICs (vNICs), 43

virtual private networks (VPNs)

review, 265

types, 248

virtualization overview, 4–5

virtualization servers

hypervisors, 85–88

review, 117

virtual machine guest configuration, 87–89

Visual Basic Script (VBS), 100

VLANs (virtual local area networks), 184, 238–239

VMFS (Virtual Machine File System), 154

vNICs (virtual NICs), 43

Voice over Internet Protocol (VoIP), 178

voltage, 46–47

Volume Shadow Service (VSS)

backups, 145

configuring, 344–345

snapshots, 339

VPNs (virtual private networks)

review, 265

types, 248

W

Wake-on-LAN (WoL) feature in NICs, 183

warm sites, 328–329

water sprinkler systems, 52

wattage, 48

WDS (Windows Deployment Services), 93

Web-Based Enterprise Management (WBEM), 95

web servers, 80–81

well-known ports, 8

Windows

ACLs, 302–303

image files, 147–148

performance monitoring tools, 307–308

permission issues, 301–302

storage troubleshooting tools, 292–294

Windows Deployment Services (WDS), 93

Windows Firewall, 240–241

Windows Internet Name Service (WINS), 77, 197

Windows Management Instrumentation (WMI), 301–302

Windows Remote Management (WinRM), 98–99

Windows Server Backup, 346–347

WINS (Windows Internet Name Service), 77, 197

Wireshark for HTTP traffic analysis, 205–206

WMI (Windows Management Instrumentation), 301–302

WMI Query Language (WQL), 302

WoL (Wake-on-LAN) feature in NICs, 183

World Wide Node Names (WWNNs), 142

World Wide Port Names (WWPNs), 142

WQL (WMI Query Language), 302

Write Once Read Many (WORM) media, 138

X

X.509 certificates, 244–245

XaaS (Anything as a Service), 17

xfs_repair tool, 294–295

Z

zones, security, 243–244

Contents

Cover

About the Author

Title Page

Copyright Page

Contents at a Glance

Contents

Acknowledgments

Introduction

Chapter 1 Introduction to CompTIA Server+ Essentials

Why This Book Is Relevant

Server Hardware Basics

Server Form Factors

Server CPUs

Server Memory

Buses and Slots

Virtualization

Environmental Factors

Storage

Network Concepts

Cables and Connectors

IP

Ports and Protocols

Server Operating Systems and Server Roles

Server Roles

Maintenance

Monitoring

Security Considerations

Hardening

Network Security

Troubleshooting and Optimizing Performance

Optimizing Performance

Troubleshooting

Preparing for the Worst

Cloud Computing

Cloud Computing Characteristics

Cloud Computing Deployment Models

Cloud Computing Service Models

Chapter Review

Questions

Questions and Answers

Chapter 2 Server Hardware

Server Form Factors

Tower Servers

Rack-mounted Equipment

Blade Servers

Server Components

BIOS

UEFI

CPUs

GPUs

Memory

Buses

NICs

Storage

USB

Power

Voltage

Wattage

Uninterruptible Power Supply

Environmental Controls

Temperature

Airflow

Humidity

Fire Suppression

Hands-on Exercises

Chapter Review

Server Form Factors

Server Components

Power

Environmental Controls

Questions

Questions and Answers

Chapter 3 Server Operating Systems and Server Roles

Server Roles

Infrastructure Roles

Other Server Roles

Virtualization Servers

Hypervisor Types

Hypervisor Host Configuration

Virtual Machine Guest Configuration

Server Installation

Server Licensing

Installing a Type 1 Hypervisor

Installing a Server Operating System

Server Administration Methods

KVM

Out-of-Band Remote Administration

In-Band Remote Administration

Server Documentation

Asset Life Cycle

Asset Inventory

Service Level Agreements

Other Documentation

Maintaining Servers

Patch Management

Proactive Maintenance

Reactive Maintenance

Hands-on Exercises

Chapter Review

Server Roles

Virtualization Servers

Server Installation

Server Administration Methods

Server Documentation

Server Maintenance

Questions

Questions and Answers

Chapter 4 Server Storage

Storage Technologies

Magnetic Hard Disks

Solid-State Drives

Hybrid Drives

Storage Tiers

Disk Interfaces

Optical Drives

Cloud Storage

Direct-Attached Storage

Network-Attached Storage

Storage Area Networks

Storage Capacity and Future Growth

Base 2 vs. Base 10

Where Did All the Disk Space Go?

Using Less Disk Space

RAID Configuration

RAID Levels

Storage Device Installation

MBR and GPT

File Systems

Sample Scenario 1

Sample Scenario 2

Hands-on Exercises

Chapter Review

Storage Device Characteristics

Disk Interfaces

Local and Network Storage

Storage Capacity Planning

RAID

Disk Initialization and File Systems

Questions

Questions and Answers

Chapter 5 Server Network Communications

The OSI Model

Cable Installation and Management

Cable Placement

Cable Labeling

Cable Types

Network Hardware

Network Interface Cards

Network Switches

Routers

Configuring IPv4

PAT

Static NAT

IP

IPv4 Addressing

Subnet Mask

Reserved Internal IP Address Ranges

When to Use Subnetting

Configuring IPv6

IPv6 Addressing

IPv6 Settings

IPv6 Transition Technologies

Network Infrastructure Services

Default Gateway

DNS Servers

WINS Servers

DHCP

TCP and UDP

TCP

UDP

Hands-on Exercises

Chapter Review

The OSI Model

Cables and Connectors

Network Interface Cards

IPv4 and IPv6

IP, TCP, and UDP

Questions

Questions and Answers

Chapter 6 Server and Network Security

Physical Security Measures

Premises Access

The Human Element

Authentication

Under Lock and Key

Logical Access Control

Groups

Dynamic Access Control

Roles

Rights and Permissions

File System Permissions

Peripheral Devices

Network Security

NAC

VLANs

Firewalls

Security Zones

PKI

IPSec

VPNs

Intrusion Detection and Prevention Systems

Hardening

Operating System Hardening

Hardware Hardening

Application Hardening

Data Security

Data and Mobile Devices

Encrypting Data at Rest

Tape Encryption

Secure Media Disposal

Hands-on Exercises

Chapter Review

Physical Security

Authentication

Logical Access Control

Network Security

Firewalls

PKI

IPSec

VPNs

Intrusion Detection and Prevention

Hardening

Data Security

Secure Media Disposal

Questions

Questions and Answers

Chapter 7 Troubleshooting and Performance Optimization

Troubleshooting Methodology

Identify the Problem

Establish a Theory of Probable Cause

Test the Theory

Establish a Plan of Action

Implement a Solution or Escalate

Verify Functionality

Perform Root Cause Analysis

Document the Solution

Hardware Problems and Solutions

Software Problems and Solutions

Storage Problems and Solutions

Windows Tools

Linux Tools

Network Problems and Solutions

Name Resolution Issues

Security Problems and Solutions

Malware Troubleshooting

Too Few Permissions

Too Many Permissions

Too Much Running

Confidentiality and Integrity

Performance Optimization

Hardware Optimization

Software Optimization

Network Optimization

Hands-on Exercises

Chapter Review

Troubleshooting Methodology

Hardware Problems and Solutions

Software Problems and Solutions

Storage Problems and Solutions

Network Problems and Solutions

Security Problems and Solutions

Performance Optimization

Questions

Questions and Answers

Chapter 8 Disaster Recovery Planning

Disaster Recovery

Alternate Sites

Data Replication

Business Impact Analysis

Business Continuity

Disaster Recovery Plan

Business Continuity Plan

Data Backup

Backup Types

Backup Media

On-premises Backup

Cloud Backup

Backup and Restore Best Practices

Hands-on Exercises

Chapter Review

Disaster Recovery Sites

Data Replication

Business Impact

Disaster Recovery Plan

Business Continuity Plan

Data Backups

Questions

Questions and Answers

Appendix A About the Hands-on Exercises and Lab Setup

Lab Exercise Overview

Microsoft Windows

Linux

Requirements for Hands-on Exercises

Hardware Requirements

VMware Workstation 16 Pro

Acquiring Windows and Linux Installation Media

Lab Exercise Miscellany

Appendix B Objective Map

Exam SK0-005

CompTIA Server+ Certification Exam SK0-005

Appendix C About the Online Content

System Requirements

Your Total Seminars Training Hub Account

Privacy Notice

Single User License Terms and Conditions

TotalTester Online

Performance-Based Questions

Technical Support

Glossary

Index

Guide

Cover

Title Page

CompTIA Server+™ Certification All-in-One Exam Guide, Second Edition (Exam SK0-005)

Page List

i

ii

iii

iv

v

vi

vii

viii

ix

x

xi

xii

xiii

xiv

xv

xvi

xvii

xviii

xix

xx

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428