CompTIA Server+ (SK0-005) Practice Questions with Explanations

Correct answer: A

Encrypting all network traffic protects data in transit, complementing full-disk drive encryption (data at rest) as part of a comprehensive data protection and data loss prevention strategy.

Why the other options are wrong:

• B. MFA enforces user authentication access control rather than protecting data against interception or unauthorized export.
• C. Blocking encrypted USB drives does not prevent data loss as effectively as controlling overall media usage or encrypting network data paths.
• D. Port security restricts physical switch access based on MAC addresses, which prevents unauthorized network connection rather than data loss from servers.

Correct answer: D

A tabletop exercise is a disaster recovery testing method where stakeholders verbally walk through each step of the disaster recovery plan in a structured meeting environment to review roles and response procedures.

Why the other options are wrong:

• A. Live failover involves actually transitioning production workloads to a secondary DR site in real time.
• B. Simulated failover runs recovery processes in an isolated environment to test systems without affecting production.
• C. Asynchronous refers to a data replication method, not a disaster recovery testing approach.

Correct answer: D

SAS (Serial Attached SCSI) drives offer high reliability, dual-port redundancy, and performance characteristics required for hosting production Type 1 hypervisors in enterprise environments.

Why the other options are wrong:

• A. SD cards are often used for diskless hypervisor boots but offer lower write endurance and lower performance compared to enterprise SAS drives.
• B. Installing a Type 1 hypervisor directly onto network-attached storage (NAS) is generally not supported for primary OS boot storage compared to direct-attached enterprise storage.
• C. SATA drives offer lower performance, single-port limitations, and lower queue depth capabilities than SAS drives.

Correct answer: D

An account lockout threshold specifies the maximum number of consecutive invalid login attempts allowed before an account is disabled or locked out, directly mitigating automated brute-force attacks.

Why the other options are wrong:

• A. Password complexity requires stronger passwords but does not prevent automated tools from attempting thousands of passwords continuous until locked out.
• B. Password reuse policies prevent users from recycling previous passwords, which does not stop brute-force login attempts.
• C. Account age thresholds enforce minimum or maximum password ages rather than locking out accounts during active attacks.

Correct answer: B

Cloning a virtual machine creates an exact copy of the VM, which can then be deployed to another host or cluster node to achieve high availability and redundancy efficiently.

Why the other options are wrong:

• A. Snapshots capture the VM's state at a point in time for recovery, but they do not provide high availability across redundant hardware.
• C. Converting to dynamic disks changes storage allocation mechanisms but does not offer high availability.
• D. Physical-to-virtual (P2V) conversion migrates a physical machine to a VM, which is not applicable since the source is already a VM.

Correct answer: B

If the server boots directly into the operating system after inserting bootable firmware media, the boot order must be adjusted or manually selected to force the server to boot from the installation media.

Why the other options are wrong:

• A. Safe mode boots the operating system with minimal drivers, which does not boot off the external firmware update media.
• C. Host-based Intrusion Detection Systems (HIDS) monitor system activity and will not facilitate a firmware flash.
• D. Logging into the OS with administrator rights will not initiate offline firmware installation media if the server failed to boot from it.

Correct answer: C

The address 172.16.19.241 falls within the RFC 1918 private IP address range of 172.16.0.0 to 172.31.255.255.

Why the other options are wrong:

• A. 11.251.196.241 is a public IP address located outside the RFC 1918 10.0.0.0/8 range.
• B. 171.245.198.241 is a public IP address outside the RFC 1918 172.16.0.0/12 range.
• D. 193.168.145.241 is a public IP address outside the RFC 1918 192.168.0.0/16 range.

Correct answer: D

The amber link light indicates a physical layer connection issue, and the ping timeouts show the server cannot reach the gateway. The ipconfig output shows the server has IP address 192.168.1.5 with subnet mask 255.255.255.0, which means the usable IP range is 192.168.1.1-192.168.1.254. However, the gateway is 192.168.1.2, which is within the same subnet and should be reachable if the NIC was properly configured. The fact that all four ping attempts timed out despite the amber link light (indicating physical connectivity exists) suggests the NIC driver is not functioning properly or the network adapter is not fully operational, rather than being a VLAN, DHCP, or port security issue. A misconfigured NIC driver or hardware issue would prevent proper network communication at the data link/network layer despite physical layer connectivity.

Why the other options are wrong:

• A. Port security would typically result in an errdisable state or red light, not an amber light with partial connectivity.
• B. VLAN misconfiguration would either prevent the link light entirely or cause consistent failures across all devices, not selective gateway unreachability.
• C. DHCP misconfiguration would affect IP address assignment but the server already has a valid static IP address configured in the correct subnet.

Correct answer: A

Implementing separate electrical circuits prevents tripping a single circuit breaker when adding high-load equipment to a server rack.

Why the other options are wrong:

• B. An uninterruptible power supply provides temporary backup power during outages but does not resolve circuit overload from overall power draw.
• C. Increasing PDU capacity does not protect the underlying utility circuit from overloading if both PDUs feed off the same circuit.
• D. Redundant power supplies protect against individual power supply unit failures but still draw power from the circuit.

Correct answer: D

Snapshots capture point-in-time states of a storage volume or fileshare rapidly, enabling fast recovery of files with minimal downtime compared to traditional backup restores.

Why the other options are wrong:

• A. LTO-4 tape media requires sequential read operations, resulting in slow restoration speeds.
• B. Restoring from an incremental backup chain requires restoring the full backup plus every subsequent incremental, taking significantly more time.
• C. Manually copying files to another partition consumes excess disk space and lacks automated, rapid point-in-time recovery capabilities.

Correct answer: B

Network Address Translation (NAT) allows multiple virtual machines on a host to share the single IP address of the physical host for external network communication by translating private VM addresses.

Why the other options are wrong:

• A. Bridged networking assigns each VM its own distinct IP address directly on the physical host network segment.
• C. Host-only networking restricts VMs to communicate only with each other and the host, preventing external access.
• D. A vSwitch is a virtual networking device that routes traffic, not an IP address sharing technique.

Correct answer: B

The environment variable %username% dynamically resolves to the logged-in user's account name in Windows UNC path mappings.

Why the other options are wrong:

• A. The trailing dollar sign ($) creates a hidden administrative share rather than dynamically inserting the user's account name.
• C. FirstInitialLastName is plain text and does not function as a variable to automatically substitute actual account names.
• D. $username$ uses incorrect variable syntax for Windows UNC path expansion.

Correct answer: C

Cloud computing environments typically utilize a subscription-based software licensing model, allowing organizations to pay recurring fees based on usage, time, or active users rather than buying perpetual licenses.

Why the other options are wrong:

• A. Per-socket licensing is traditional on-premises licensing based on physical CPU sockets.
• B. Perpetual licensing involves a one-time upfront purchase for permanent software use, which is rare in cloud models.
• D. Site-based licensing covers an entire physical facility or campus rather than cloud deployment models.

Correct answer: B

Port 22 is used by Secure Shell (SSH), which provides encrypted and secure remote CLI access to servers.

Why the other options are wrong:

• A. Port 21 is used for unencrypted File Transfer Protocol (FTP) command control.
• C. Port 23 is used for Telnet, which transmits data and login credentials in cleartext.
• D. Port 443 is used for HTTPS web traffic rather than remote command-line server administration.

Correct answer: A

Insider threats involve users with legitimate access who can bypass technical security controls like firewalls, antivirus, and anti-malware software.

Why the other options are wrong:

• B. Worms are automated malware threats effectively detected and blocked by functioning antivirus and firewall rules.
• C. Ransomware is malicious software designed to encrypt files, which properly updated endpoint anti-malware protects against.
• D. Open ports are potential network access points, but firewalls and defensive controls secure them against external threats.
• E. Two-person integrity is an administrative security control, not a system vulnerability.

Correct answer: D

Downgrade rights allow an organization that purchases a license for a newer version of an operating system to legally install and run an older version under that same license.

Why the other options are wrong:

• A. Downgrade rights do not involve returning or requesting a refund for a new operating system license.
• B. Downgrade rights do not permit running servers below recommended hardware requirements without a license.
• C. Downgrade rights do not grant additional test environment licenses; they only permit substituting the licensed version with an older version.

Correct answer: C

When a Linux network interface set to DHCP cannot contact a DHCP server to obtain an IP address, it fails to acquire a valid network configuration and defaults or falls back improperly, resulting in missing or loopback configurations.

Why the other options are wrong:

• A. Multiple scope options would not cause the network interface to lack a valid unicast network IP address.
• B. An incorrect subnet mask sent by DHCP would still assign a valid network IP address to the interface rather than leaving it unconfigured.
• D. An incorrect MTU setting affects packet fragmentation and throughput, not basic IP address acquisition.

Correct answer: D

A port scanner actively probes remote systems and performs service banner grabbing to identify active network applications without requiring administrative login credentials.

Why the other options are wrong:

• A. User Account Control is a local administrative security control in Windows and cannot scan remote services.
• B. Anti-malware operates locally to detect malicious software rather than assessing remote open ports and network services.
• C. A network sniffer passively captures network traffic passing by an interface, requiring existing traffic rather than actively probing remote ports for services.

Correct answer: D

SCP (Secure Copy Protocol) uses SSH to securely transfer files across different operating systems, such as from Linux to Windows workstations.

Why the other options are wrong:

• A. Telnet transmits data in plain text without encryption and is an unsecure remote terminal access protocol, not a dedicated file transfer tool.
• B. Robocopy is a native Windows command-line utility used for copying files between SMB network shares or local drives, not native Linux systems.
• C. XCOPY is a legacy Windows command-line utility for copying files within Windows file systems.

Correct answer: C

YUM downloads RPM packages and metadata to the /var/cache/yum directory and writes to /var/log/yum.log. If the /var partition runs out of disk space, YUM will throw various error messages during the update process, making disk space in /var the first thing to inspect.

Why the other options are wrong:

• A. If network connectivity were lost, remote access to the server would not be working.
• B. Logical Volume Manager (LVM) status issues typically prevent mounting rather than causing specific application update errors.
• D. Checking dependencies comes later if package resolution fails, but disk space exhaustion in /var is the most common cause of sudden YUM errors.

Correct answer: D

When a failed drive in a fault-tolerant storage array (such as RAID 1 or RAID 5) is replaced, the administrator must rebuild the volume. This process regenerates the lost data onto the new replacement drive using parity or mirrored data from the remaining drives.

Why the other options are wrong:

• A. Initializing a volume prepares a disk for use but wipes configuration and data rather than recovering the existing logical volume.
• B. Formatting a volume creates a new file system on the volume, which erases all existing data.
• C. Replacing the volume involves destroying and re-creating the storage allocation, leading to complete data loss.

Correct answer: C

The local hosts file overrides DNS resolution; a custom or misconfigured host entry on one system causes ping to resolve hostnames to different IP addresses.

Why the other options are wrong:

• A. A misconfigured firewall blocks or permits network packets, but it cannot alter hostname IP resolution during a ping test.
• B. The hosts.deny file restricts access to system services via TCP wrappers but does not handle domain name resolution.
• D. The hosts.allow file grants access to TCP wrapper services and does not influence domain name to IP mapping.

Correct answer: A

A subnet mask of 255.255.255.0 (/24) provides a single IP network range from 10.20.10.1 to 10.20.10.254. Both the host IP address 10.20.10.15 and the default gateway 10.20.10.254 fall within this same subnet broadcast domain, allowing communication between the server and gateway.

Why the other options are wrong:

• B. A mask of 255.255.255.128 splits the octet into subnets 0-127 and 128-255, placing 10.20.10.15 and 10.20.10.254 on different subnets.
• C. A mask of 255.255.255.240 creates subnets of 16 addresses, placing 10.20.10.15 as a broadcast address and 10.20.10.254 in a separate subnet.
• D. A mask of 255.255.255.254 (/31) supports only two IP addresses in a point-to-point link and cannot accommodate both .15 and .254 together.

Correct answer: C

Once a new backup scheme is configured, conducting a restore test is essential to verify that the backup process successfully captured the data and that it can be reliably recovered.

Why the other options are wrong:

• A. Overwriting existing backups before testing the new backup scheme risks permanent data loss.
• B. Cloning the configuration of an unverified backup scheme risks replicating configuration errors or failures.
• D. Checking media integrity verifies physical storage health but does not prove that the software backup and recovery process works.

Correct answer: A

Bollards are sturdy short vertical posts designed to physically block motor vehicles from approaching or crashing into building entrances and pedestrian areas.

Why the other options are wrong:

• B. Reflective glass reduces visibility into a building and manages heat, but it does not stop vehicle access.
• C. Security guards monitor and control access, but they cannot physically block a vehicle moving at high speed.
• D. Security cameras provide surveillance and recording, but they do not physically impede physical movement.

Correct answer: C

A load average of 60.5 on a dual-core server indicates severe system resource exhaustion, as a dual-core CPU can handle a sustained load average of 2.0 efficiently. The administrator should immediately identify the runaway process or processes using process inspection tools to terminate or re-prioritize them.

Why the other options are wrong:

• A. Rebooting the server without investigation may temporarily clear the load but does not identify the root cause or prevent it from recurring.
• B. Waiting for a load average of 60.5 to drop on its own risks server crash or complete unresponsiveness.
• D. Asking users to log off is premature and ineffective if the load is caused by a system process or single runaway service.

Correct answer: C

Recovery Time Objective (RTO) represents the targeted duration of time within which a business process must be restored after a service disruption to avoid unacceptable consequences.

Why the other options are wrong:

• A. Service Level Agreement (SLA) is a formal contract outlining agreed-upon service performance metrics between a provider and customer.
• B. Mean Time Between Failures (MTBF) measures the predicted operating time between inherent component failures.
• D. Mean Time To Repair (MTTR) is the average time required to repair and restore a failed system component.

Correct answer: C

The mount -o remount,rw command remounts an already-mounted filesystem with read- write permissions. Since the disk was already mounted but users couldn't create files/directories, it was likely mounted read-only. This command remounts it with rw (read- write) options, allowing file creation. The other options don't address the core issue: echo to fstab doesn't remount, net use is Windows-only, and mount -a remounts all filesystems in fstab without specifying needed parameters.

Why the other options are wrong:

• A. Adding to /etc/fstab only affects future mounts, not the currently mounted filesystem.
• B. net use is a Windows command and irrelevant on Linux systems.
• D. mount -a remounts filesystems from /etc/fstab but doesn't specify rw permissions.

Correct answer: C

RAID 6 utilizes dual distributed parity, allowing up to two hard drive failures without data loss, and consumes only two drives' worth of capacity (N-2) for overhead, preserving more usable storage than RAID 10 across eight drives.

Why the other options are wrong:

• A. RAID 0 offers zero fault tolerance and fails if even a single drive experiences a failure.
• B. RAID 5 uses single parity and can only survive a single drive failure before data loss occurs.
• D. RAID 10 provides two-drive fault tolerance only under specific conditions and loses 50% (four drives) of total storage capacity to overhead.

Correct answer: D

The user permissions were set to read and execute (r-x, or 5), preventing Ann from writing or saving files to her home directory. Changing permissions to 754 grants the owner read, write, and execute permissions (7) while maintaining the original group (5) and others (4) permissions without granting excessive access.

Why the other options are wrong:

• A. chmod 777 grants full read, write, and execute permissions to everyone, which violates the principle of least privilege.
• B. chmod 666 grants read and write permissions to everyone but removes execute permissions needed to traverse directories.
• C. chmod 711 removes read permissions for group and others, unnecessarily restricting existing directory access.

Correct answer: C

The df -h command displays disk space usage for file systems in a human-readable format, allowing technicians to quickly verify if the target directory's partition has run out of space.

Why the other options are wrong:

• A. The pvdisplay command shows information about LVM physical volumes rather than available file system disk space.
• B. The mount command lists currently mounted file systems but does not report disk usage details or space capacity.
• D. The fdisk -l command displays partition table information rather than current disk space usage.

Correct answer: A

IP KVM (Keyboard, Video, Mouse over IP) provides out-of-band, hardware-level remote access to a server's console regardless of the operating system state, making it ideal for bare-metal maintenance.

Why the other options are wrong:

• B. VNC relies on an operating system service and GUI environment, making it unsuitable for bare-metal administrative access.
• C. A crash cart requires physical presence in the remote datacenter rather than remote access.
• D. RDP requires a running Windows operating system and network stack, rendering it unavailable during bare-metal maintenance.
• E. SSH requires an operating system with network and SSH services running, so it cannot be used for bare-metal server access.

Correct answer: D

The netstat -a command lists all active network connections and listening TCP/UDP ports on the server.

Why the other options are wrong:

• A. The nslookup command is used to query DNS servers for domain name resolution, not to list open local ports.
• B. The nbtstat command displays NetBIOS over TCP/IP statistics, not general open listening network ports.
• C. The telnet command is used to connect to a specific remote service and port, not to audit all local open ports.

Correct answer: A

The getenforce command indicates SELinux is currently Enforcing, which can block MySQL configuration or services. Running setenforce 0 temporarily switches SELinux to Permissive mode without requiring a reboot.

Why the other options are wrong:

• B. The setenforce command requires 0 or 1, or Enforcing/Permissive capitalized; setenforce 0 is the standard syntax used to switch to permissive mode.
• C. Running setenforce 1 sets SELinux back to Enforcing mode, which would continue blocking MySQL.
• D. SELinux cannot be completely disabled using setenforce; disabling it requires modifying /etc/selinux/config and rebooting.

Correct answer: B

Encrypting data at rest protects stored data on SAN physical drives from being read or compromised if physical media is stolen or leaked.

Why the other options are wrong:

• A. Encrypting data leaving the SAN protects data in transit, but does not secure the stored data on the SAN disks if the physical array is compromised.
• C. Encrypting host servers protects local host operating systems, but does not protect storage volumes hosted on the SAN.
• D. Encrypting network traffic prevents eavesdropping on data in transit, but leaves static data at rest on the SAN unprotected.

Correct answer: B

Installing an SSL/TLS certificate from a recognized Certificate Authority binds identity credentials to the web server, enabling HTTPS and ensuring browsers trust the connection.

Why the other options are wrong:

• A. PKI is the overall framework of hardware, software, and policies supporting digital certificates, not a single component installed on a web server.
• C. LDAP is a directory access protocol used for user authentication and directory services, not for securing web browser connections.
• D. DNS resolves domain names to IP addresses but does not establish security or cryptographic trust for a website.

Correct answer: D

A UPS (Uninterruptible Power Supply) provides battery backup power during brief electrical outages, keeping servers operational and preventing unexpected shutdowns.

Why the other options are wrong:

• A. A KVM switch allows management of multiple servers from one console but provides no power backup capability.
• B. Cable management neatly organizes cables to improve airflow and prevent accidental unplugging, but cannot maintain power during an outage.
• C. Redundant network connections protect against network interface or switch failures, not power grid failures.

Correct answer: D

An operating system cannot authenticate Active Directory domain users until the computer account has been joined to the Active Directory domain.

Why the other options are wrong:

• A. Port 443 is used for HTTPS web traffic, which is not required for standard Active Directory domain authentication.
• B. Downstream failures affect subsequent network hops, but network connectivity to and from the server was verified using ping.
• C. The local hosts file is not required for domain authentication when standard DNS is functioning.

Correct answer: B

An active-active configuration is a load balancing model where two or more nodes simultaneously process incoming network traffic and share the workload.

Why the other options are wrong:

• A. Round robin is a scheduling algorithm used by load balancers rather than a high- availability server configuration mode itself.
• C. Active-passive is a redundancy and failover topology rather than an active traffic load-balancing technique.
• D. Failover refers to switching operations to a backup server upon failure, which is a high-availability mechanism rather than load balancing.

Correct answer: B

GPT (GUID Partition Table) supports disk volumes larger than 2TB, whereas traditional MBR partition tables are limited to a maximum size of 2TB.

Why the other options are wrong:

• A. UEFI compliance is necessary to boot an OS from a GPT disk larger than 2TB, but formatting a data-only volume as GPT does not strictly require UEFI firmware.
• C. MBR partition schemes do not support single partition sizes exceeding 2TB.
• D. Spanning across physical drives creates dynamic volumes but does not overcome the 2TB partition limit imposed by MBR.

Correct answer: A

The best course of action to resolve a known application vulnerability reported by a security scanner is to upgrade or patch the specific application package. This directly fixes the underlying flawed code or security hole identified in the report.

Why the other options are wrong:

• B. Tightening firewall rules provides network perimeter control but does not remediate the core software flaw within the application.
• C. Installing antivirus software helps detect malicious files but does not patch software vulnerabilities in application code.
• D. Patching the server operating system updates OS components, but it does not update or fix vulnerabilities in third-party applications.

Correct answer: B

Shell scripting (such as Bash) is the native and most appropriate environment for creating login and startup scripts on Linux operating systems.

Why the other options are wrong:

• A. VBScript is a legacy Windows scripting language and is not natively supported on Linux.
• C. Java is a compiled programming language rather than a lightweight native shell scripting language for Linux user logins.
• D. PowerShell is primarily designed for Windows environments, although cross-platform versions exist, it is not the standard choice for Linux logon scripts.
• E. Batch scripts (.bat/.cmd) are native to DOS and Windows Command Prompt, not Linux.

Correct answer: B

Installing the heaviest equipment at the bottom of a rack keeps the center of gravity low, preventing the rack from tipping over and making installation safer.

Why the other options are wrong:

• A. Airflow in a data center rack should be consistent (e.g., front-to-back hot/cold aisle containment) rather than alternated.
• C. Uninterruptible power supplies are among the heaviest components and should be placed at the bottom, not the top.
• D. Leaving 1U of empty space between every server wastes rack space and disrupts efficient airflow management.

Correct answer: C

A Security Information and Event Management (SIEM) system collects, correlates, and analyzes log data from multiple network sources in real time to detect and alert on suspicious security events.

Why the other options are wrong:

• A. Syslog is a protocol used for forwarding log messages, but it lacks real-time automated correlation and threat analysis capabilities.
• B. Data Loss Prevention (DLP) focuses on detecting and preventing sensitive data exfiltration rather than analyzing general system logs.
• D. Host-based Intrusion Prevention System (HIPS) monitors a single host for malicious activity rather than analyzing network-wide logs centrally.

Correct answer: B

Failback is the process of returning services and workload operations back to the primary or original active server node after a failover event has occurred and the primary server has been restored to service.

Why the other options are wrong:

• A. A heartbeat is a periodic signal sent between cluster nodes to monitor system health and detect node failures.
• C. Redundancy refers to having duplicated hardware or software components to avoid a single point of failure.
• D. Load balancing distributes incoming workload traffic across multiple active cluster nodes simultaneously.

Correct answer: D

A guest OS is an operating system installed and executed within a virtual machine managed by a hypervisor running on the host system.

Why the other options are wrong:

• A. The host refers to the physical hardware or underlying operating system that executes the hypervisor.
• B. A network bridge links virtual network interfaces to physical network interfaces, not an OS installation.
• C. A hypervisor is the software, firmware, or hardware layer that creates and runs virtual machines.

Correct answer: D

Because the network communication failure occurred immediately following a firmware update, downgrading (rolling back) the NIC firmware is the fastest initial troubleshooting step to return the server to service.

Why the other options are wrong:

• A. Replacing the physical card is time-consuming and unnecessary when the issue was triggered by a software/firmware update.
• B. Checking the hardware compatibility list does not immediately restore server functionality.
• C. Reseating the network interface card is unlikely to fix a problem caused by a firmware flash.

Correct answer: B

A disaster recovery plan (DRP) specifically details the technical processes and procedures required to restore IT infrastructure, systems, and operations after an unplanned disruption.

Why the other options are wrong:

• A. A service-level agreement defines service commitment metrics between a provider and a client, not recovery procedures.
• C. A business impact analysis identifies and evaluates the potential effects of a disruption on business operations rather than providing restoration steps.
• D. A business continuity plan focuses on sustaining overall business operations during a crisis, whereas a DRP specifically targets IT infrastructure recovery.

Correct answer: A

SAS SSDs combine the high IOPS and low latency of solid-state drives with the robust enterprise reliability, dual-port redundancy, and performance capabilities of the SAS interface, making them ideal for high-performance financial applications.

Why the other options are wrong:

• B. SATA SSDs lack the dual-port redundancy and higher queue depths provided by SAS enterprise drives.
• C. SAS 10,000 RPM mechanical drives are significantly slower than SSDs in terms of latency and IOPS.
• D. 15,000 RPM SATA HDDs do not exist, and mechanical hard drives cannot match SSD performance.

Correct answer: C

Disk quotas allow administrators to set limits on the amount of storage space each user can consume, directly linking total storage usage to the number of active users.

Why the other options are wrong:

• A. Partitioning logically divides a drive into separate volumes but does not cap individual user storage consumption.
• B. Deduplication eliminates duplicate data copies to save space but does not correlate storage usage directly to user counts.
• D. Compression reduces the overall size of files on disk but does not restrict individual user storage allocation.