SY0-701 Security Operations Practice Question
A critical patch must be applied to a production server next week. What is the best way to reduce the risk of downtime if the patch causes a problem?
⚠ Common exam trap
Candidates often assume applying a patch during business hours allows for quick user feedback, but this overlooks the higher risk of widespread disruption and the importance of a controlled maintenance window.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a rollback plan before installing the patch
Creating a rollback plan before installing a patch ensures that if the patch causes unexpected issues, the system can be restored to its previous stable state quickly, minimizing downtime. A rollback plan typically includes steps to revert the patch, restore from a backup, or switch to a failover system, which is a fundamental change management practice in security operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the patch during business hours so users can report issues quickly
Why it's wrong here
Applying a patch during business hours maximizes user disruption because the server is under load and failures directly impact active transactions, causing data loss or user-facing downtime. Users reporting issues in real time does nothing to prevent the damage; it only adds noise and distracts the support team. Maintenance windows exist to minimize impact, so a failed patch at this time can create a public outage and erode customer trust.
- ✓
Create a rollback plan before installing the patch
Why this is correct
A rollback plan is a documented series of steps to restore the server to its previous known-good state, including pre-verified backups of data and configuration files, snapshots, and validation checks. It establishes a safe exit strategy so that if the patch causes unforeseen failures—such as application incompatibility or data corruption—the team can rapidly revert, minimizing downtime and data loss. This is a foundational component of change management and is more important than the patch itself in preserving service reliability.
- ✗
Skip testing because critical patches are always safe
Why it's wrong here
Critical patches address vulnerabilities but are still untested against your specific server's configuration, applications, and custom tweaks; they have been tested by the vendor, not in your environment. Skipping testing to save time can introduce regressions, break dependencies, or conflict with other software, creating a production outage worse than the vulnerability. A proper process validates the patch in a staging environment or at minimum verifies backups and compatibility before deployment, since 'critical' means urgent, not reckless.
- ✗
Disable logging during the patch to improve performance
Why it's wrong here
Disabling logging during a patch removes your ability to audit the change, verify component status, and capture error messages if the patch fails, yet it offers only negligible performance gains on modern hardware. Logs are the primary tool for post-incident analysis and forensic investigation; without them, the root cause of a failure may remain undetected, and security compliance frameworks like PCI-DSS often mandate continuous logging. A reliable patch process preserves logging to ensure the system's health can be observed in real time.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Change management
Change management is the structured process of planning, approving, implementing, and reviewing changes to IT systems to minimize risk and disruption.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.