Examkin

Question

Difficulty: Very hardPatch Management and Software Maintenance

A senior network operations engineer must deploy a critical vendor-issued firmware security patch to an active/passive high-availability pair of core enterprise switches. The patch addresses an unauthenticated remote code execution vulnerability but requires a complete system reboot of each appliance. To maintain zero unmanaged downtime, protect configuration state, and adhere to strict enterprise patch management procedures, which of the following operational workflows should the engineer execute?

  1. Submit a change request to the Change Advisory Board (CAB), perform configuration and baseline state backups, validate the firmware update in a non-production staging environment, schedule a maintenance window, execute a rolling upgrade beginning with the standby switch, and verify redundancy prior to updating the active switch.Answer
  2. B
    Immediately push the firmware update directly to the primary active switch during peak operational hours to eliminate security exposure, skipping pre-deployment lab testing and taking configuration backups only after the switch successfully reboots.
  3. C
    Perform a complete system image restore using the previous week's incremental backup directly onto the primary switch before starting the live firmware installation file transfer.
  4. D
    Reconfigure the Virtual Router Redundancy Protocol (VRRP) master node to point directly to an external public IP address rather than the local virtual gateway IP (VIP) to maintain routing throughout the reboot sequence.

Answer

The correct workflow requires securing Change Advisory Board authorization, backing up the current baseline configuration, testing the patch in a non-production lab environment, scheduling an approved maintenance window, and performing a rolling upgrade starting with the standby switch before updating the active node.
The standard patch management lifecycle for high-availability enterprise environments requires change management authorization, configuration state backup, staging environment verification, scheduled maintenance windows, and a staged rolling update starting with non-active nodes to guarantee continuous availability and rapid recovery capabilities.

Step-by-Step Solution

1
Initiate governance and backup procedures
Change request approval is granted by the Change Advisory Board and current configuration/state backups are secured.
Governance ensures organizational awareness while backups provide a rollback baseline in case of patch failure.
2
Staging and sandbox testing
The firmware patch is applied in an isolated non-production environment.
Lab testing identifies unexpected bugs, protocol instability, or dependency breakages before impacting production traffic.
3
Execute rolling deployment during an authorized maintenance window
The passive/standby switch is updated and rebooted first while the active switch continues forwarding production traffic.
Updating the secondary node first maintains continuous uptime across the high-availability pair and validates patch stability.
4
Failover validation and primary switch update
Traffic is gracefully failed over to the updated secondary switch, after which the primary switch is patched and updated.
Ensures that both devices are successfully updated with verified failover readiness and no loss of operational integrity.

Key Concept

Enterprise Patch Management Lifecycle and High-Availability Maintenance
Estimated Time:2m 0s
Rate this question

Topics

Patch Management and Software Maintenance

More questions from this topic