An in-place upgrade is planned for a sealed public-health appliance with no parallel standby. What risk should operators accept?
Select an answer to reveal the explanation.
Short Explanation
In-place on a sealed public-health box is remodeling the only kitchen while dinner is cooking—undo is limited. It is not a warm blue-green flip with a spare kitchen waiting.
Full Explanation
In-place upgrades mutate the existing instance, so rollback is limited or slower than strategies that keep a prior environment warm. A sealed public-health appliance with no parallel standby forces operators to accept that tradeoff: you remodel the only box while it is in service, and undo means restore from backup, re-image, or vendor recovery—not an instant blue-green flip. Municipal public-health appliances often have licensing or hardware seals that preclude dual environments, so the risk acceptance is explicit.
Claiming instant zero-risk rollback identical to a warm blue-green switch fails by concept because in-place has no second environment to flip to. Unlimited horizontal canary slices without a second instance fails because canary percentage routing needs somewhere else to send the slice. Automatic dual-environment failover that in-place upgrades always include fails because dual environments are exactly what in-place does not provide.
Exam caveat: choosing in-place under constraint is valid; denying the rollback limitation is not. Pair in-place public-health upgrades with tested backups, maintenance windows, and vendor rollback notes. Do not market in-place as equivalent to blue-green rollback speed on the exam.
Operational check: before upgrading the sealed appliance, take a verified backup/snapshot, document the restore procedure and RTO, perform the in-place upgrade, and confirm operators understand that failure recovery is restore—not a standby traffic switch.