First Step Before Patching a High-Availability Production VM

SY0-601 By islever Editorial Last updated

Short answer

D Take a snapshot of the VM to establish an immediate rollback point before applying the OS update.

Question

The Chief Information Security Officer (CISO) asks a security analyst to install an OS update to a production VM that has a 99% uptime SLA. The CISO tells the analyst the installation must be done as quickly as possible. Which of the following courses of action should the security analyst take first?
  1. Log in to the server and perform a health check on the VM.
  2. Install the patch immediately.
  3. Confirm that the backup service is running.
  4. Take a snapshot of the VM. Correct Answer

Key Takeaways

The question tests change management procedures for high-availability environments, where candidates often overlook the immediate need for a rapid rollback mechanism in favor of direct patching.

When applying OS updates to a critical production VM with a strict uptime SLA, creating a point-in-time recovery option is essential to minimize downtime. This page establishes that taking a VM snapshot is the mandatory first step before initiating any patches or configuration changes.

Common mistake: Candidates frequently select Install the patch immediately due to the pressure to complete the task quickly, ignoring that a failed update would violate the 99% uptime SLA and require significantly longer recovery time.

Expert Analysis

Why the Answer Is Correct

Taking a snapshot captures the exact current state of the virtual machine, providing an instant rollback point if the OS update introduces instability or breaks critical services. For a system bound by a 99% uptime SLA, reverting from a snapshot takes minutes rather than hours required for full restoration, ensuring compliance with strict availability targets. CompTIA Security+ explicitly prioritizes pre-change validation and recovery planning in all infrastructure modification scenarios.

Why the Other Options Are Wrong

Performing a health check does not protect against failure during the update itself. Installing the patch immediately bypasses change control safeguards and risks prolonged downtime if the update fails. Confirming the backup service is running verifies tool readiness but does not actually create a recoverable point-in-time image needed for rapid reversion.

Community Comment Notes

Learners consistently emphasize that snapshots serve as the fastest fallback mechanism for active databases without requiring services to be stopped. As user shady23 noted, "Taking a snapshot of the VM would be the first course of action" because it ensures a quick revert path. Multiple commenters agree that traditional copy-based backups cannot reliably capture open files, making the snapshot the only viable first step under tight time pressure.

Exam Strategy

Always identify the constraint driving the scenario; here, the 99% uptime SLA dictates that speed of recovery matters more than traditional backup methods. Memorize the change management sequence: request approval, verify dependencies, create recovery point, implement change, validate, and document.

Frequently Asked Questions

Why isn't confirming the backup service the first step?

Verifying a backup service only checks tool status, whereas a snapshot creates an actual point-in-time image required for rapid reversion under SLA pressure.

Can I skip the snapshot if the update is low risk?

No. CompTIA exam doctrine mandates a verified recovery point before any production change, regardless of perceived risk, to prevent SLA violations.

More SY0-601 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Yomzie 👍 4
    VM typically requires taking a SNAPSHOT, before doing anything else that could alter the "system state" of the machine.
  2. 7308365 👍 2
    D. Take a snapshot of the VM Snapshots are a means of getting around open files. If the data you're considering backing up is part of a database, such as SQL data or an Exchange messaging system, the the data is probably being used all the time. Often copy-based mechanisms will be unable to back up open files. Short of closing the files, and so too the database a copy-based system will not work. A snapshot is a point-in-time copy of data maintained by the file system. A backup can use the snapshot rather than the live data to perform the backup. Virtual system managers can usually take snapshot or cloned copies of VMs.
  3. shady23 👍 2 Answered D
    D. Take a snapshot of the VM. Taking a snapshot of the VM would be the first course of action. By taking a snapshot, the security analyst creates a point-in-time backup of the VM's current state. This ensures that if any issues arise during the OS update installation process, the VM can be quickly reverted to its previous state without affecting the production environment. Once the snapshot is taken, the security analyst can proceed with confidence to install the OS update, knowing that there is a backup available in case of any unforeseen complications.
  4. Jay987654 👍 1 Answered D
    The security analyst should first D. Take a snapshot of the VM. Taking a snapshot of the virtual machine (VM) before making changes provides a fallback option in case something goes wrong during the update process. It allows the analyst to quickly revert the VM to its previous state, minimizing downtime and ensuring the system maintains its 99% uptime Service Level Agreement (SLA). This is a best practice in managing changes in a production environment, especially when high availability is a requirement.
  5. Hs1208 👍 3 Answered D
    Snapshot

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

MFA and Patch Management Control Type and Category

S-grade

Threat Hunting Data Sources for Exploitable Systems

S-grade

Full Weekly and Differential Daily Backup Strategy

S-grade

Access Auditing as the SaaS Vendor Risk to Focus On

S-grade

← Back to SY0-601 Study Guide