220-1102 Operational Procedures Practice Question
A change advisory board (CAB) has approved a plan to update firmware on 50 servers. During the implementation, two servers fail to update and become unbootable. According to change management best practices, what should the technician do FIRST?
⚠ Common exam trap
Test-takers frequently choose 'Document the failure' (Option D) because they think logging is the first step in incident management, but change management protocols prioritize restoring service via the rollback plan before any documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Execute the rollback plan
The correct first step is to execute the rollback plan (Option C). Change management best practices require that any approved change includes a documented rollback plan to revert the system to its previous stable state in case of failure. Since two servers are unbootable, the technician must immediately restore service by reversing the firmware update, not by continuing, re-imaging, or documenting first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Continue with the remaining servers
Why it's wrong here
Continuing to update the remaining servers after several failures is the opposite of containing the incident: the same update may be faulty across the fleet, and pushing it further risks cascading outages and violates the change management principle of stabilizing the environment first. The approved change plan would mandate a halt and rollback upon any failed implementation, not a continuation. Proceeding could also invalidate the change approval and complicate post-incident review.
- ✗
Re-image the failed servers from backup
Why it's wrong here
Re-imaging the failed servers from backup is a specific tactical action that may indeed be part of the documented rollback plan, but performing it unilaterally without first executing that plan is premature. The rollback plan might specify a different sequence, such as reverting configuration, restoring a prior snapshot, or applying a hotfix, and re-imaging could destroy diagnostic data needed to identify the root cause. The immediate, correct first step is to execute the rollback plan as written, not to improvise a recovery action.
- ✓
Execute the rollback plan
Why this is correct
Executing the rollback plan is the correct and immediate action because every approved change plan in a mature change management process includes a documented rollback procedure precisely for this scenario. When the update fails, the technician must follow that pre-approved plan to revert affected servers to their last known-good state, minimizing downtime and restoring service as quickly as possible. This aligns with the CAB's approval and ensures that recovery steps are controlled, auditable, and consistent with organizational policy.
- ✗
Document the failure in the ticketing system
Why it's wrong here
Documenting the failure in the ticketing system is a good practice but does nothing to stop the ongoing failure or restore service; ticket documentation should occur in parallel or after the immediate mitigation. Treating documentation as the first response would delay the rollback, potentially extending the outage window and making the impact worse. The correct priority is to contain the incident by executing the rollback plan, then use documentation to support the post-incident report and continuous improvement.
Go deeper
Related to this question
Learn chapter
Disk Imaging and OS Deployment
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
Key term
Firmware update
A firmware update is a process that replaces or patches the permanent software programmed into a hardware device to fix bugs, patch security vulnerabilities, or add new features.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.