Patching OS in Auto Scaling Groups with Rolling Updates
An SAP NetWeaver administrator needs to patch the operating system of an SAP application server running in an Auto Scaling group. The instances are behind an Application Load Balancer. What is the correct procedure to minimize downtime?
Quick Answer
Patching an OS across an Auto Scaling group behind a load balancer without causing downtime requires a strategy that never drops below the capacity needed to serve traffic, and that's exactly what a rolling update with lifecycle hooks accomplishes. Building a new AMI with the OS patches applied, then using Auto Scaling's rolling update mechanism, launches new patched instances first and confirms they're healthy, aided by lifecycle hooks, which let you pause the process at defined points to run validation or configuration steps, before deregistering and terminating the old, unpatched ones. Because instances are replaced incrementally rather than all at once, the Application Load Balancer always has a pool of healthy instances to route traffic to throughout the process. This is a meaningfully different approach from manually detaching instances to patch them one at a time outside of Auto Scaling's automation, which risks inconsistent AMI versions across the fleet and loses the built-in health checking and orchestration that lifecycle hooks provide. It's also different from stopping traffic at the load balancer or terminating all instances simultaneously, both of which cause a full outage rather than a controlled, incremental replacement. The general pattern to recognize is that whenever a question asks how to patch instances in an Auto Scaling group with minimal downtime, the answer almost always centers on replacing instances gradually from a new, patched AMI via a rolling update, rather than patching instances in place or taking the whole fleet offline at once.
⚠ Common exam trap
A common mistake is to think that stopping traffic to the ALB or manually patching instances is acceptable, but the correct approach uses Auto Scaling rolling updates with lifecycle hooks to automate the process and minimize downtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an Auto Scaling rolling update with lifecycle hooks to launch new instances from a patched AMI and gradually deregister old ones.
It uses Auto Scaling rolling updates with lifecycle hooks to replace instances one by one, minimizing downtime by ensuring new instances are healthy before old ones are terminated. Option B is wrong because manually detaching and patching does not leverage Auto Scaling's automation and can lead to inconsistent AMIs. Option C is wrong because stopping traffic at the ALB causes full downtime during patching. Option D is wrong because terminating all instances at once causes full downtime, and the new instances may not be immediately available.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use an Auto Scaling rolling update with lifecycle hooks to launch new instances from a patched AMI and gradually deregister old ones.
Why this is correct
This minimizes downtime by replacing instances one at a time while maintaining capacity.
- ✗
Detach one instance from Auto Scaling, patch it, test, then reattach.
Why it's wrong here
Detaching does not trigger automated replacement; the instance must be terminated to be replaced.
- ✗
Stop accepting traffic at the ALB, patch all instances manually, then re-enable traffic.
Why it's wrong here
This approach causes full downtime during patching.
- ✗
Terminate all instances at once and let Auto Scaling launch new ones with a patched AMI.
Why it's wrong here
Terminating all instances causes complete application downtime.
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An SAP administrator needs to patch the operating system of SAP application servers that are part of an Auto Scaling group. What is the best practice to ensure that instances are updated without downtime?
hard- A.Update the AMI used by the Auto Scaling group launch configuration and manually terminate all running instances.
- ✓ B.Create a new launch configuration with an updated AMI and perform a rolling update using the Auto Scaling group.
- C.Update the AMI and stop the Auto Scaling group, then start it again.
- D.Install patches on each running instance using AWS Systems Manager Patch Manager.
Why B: A rolling update replaces instances gradually, maintaining capacity. Option A is wrong because it does not address replacement. Option C is wrong because it causes downtime. Option D is wrong because it does not apply to running instances.
Variation 2. An SAP Basis administrator needs to apply an OS-level security patch to a fleet of SAP EC2 instances running Red Hat Enterprise Linux. The instances are part of an Auto Scaling group. Which approach is the MOST efficient and minimizes downtime?
easy- A.Create a custom AMI and manually terminate each instance to launch new ones.
- B.Stop all instances, apply the patch using a script, and restart them.
- C.Use AWS Systems Manager Patch Manager to apply the patch to all instances simultaneously.
- ✓ D.Create a new AMI with the patch applied, update the launch template, and perform a rolling update via Auto Scaling.
Why D: The most efficient and minimizes downtime because it uses a rolling update strategy. By creating a new AMI with the patch applied and updating the launch template in the Auto Scaling group, instances are gradually replaced without stopping all at once. Option A is incorrect because manually terminating instances is not efficient and doesn't leverage Auto Scaling automation. Option B is incorrect because stopping all instances to apply a patch causes downtime. Option C is incorrect because while Systems Manager Patch Manager can apply patches, simultaneous patching without a rolling update risks service disruption, especially if reboots are required. The rolling update via Auto Scaling ensures high availability.
Variation 3. An SAP administrator needs to apply a security patch to the operating system of an EC2 instance running SAP. The instance is part of an Auto Scaling group. What is the best practice to apply the patch while minimizing downtime?
easy- ✓ A.Create a new AMI with the patch applied, update the launch configuration, and perform a rolling update using an Auto Scaling lifecycle hook.
- B.Update the launch configuration with the patched AMI and manually terminate running instances.
- C.Stop the Auto Scaling group, patch the instance, and restart the group.
- D.SSH into each instance and apply the patch manually.
Why A: The best practice because it leverages a lifecycle hook to perform a rolling update, replacing old instances with new ones based on a patched AMI without downtime. This approach ensures that each instance is gracefully terminated after a new instance is ready. Option B is incorrect because simply updating the launch configuration and manually terminating instances can cause downtime and is not automated. Option C is incorrect because stopping the Auto Scaling group and patching in place leads to downtime and is not scalable. Option D is incorrect because applying patches manually via SSH is error-prone and requires sequential instance patching, causing downtime.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.