A stateful network appliance used for city VPN aggregation cannot easily run two versions side by side. Which deployment strategy is most realistic for its upgrade?
Select an answer to reveal the explanation.
Short Explanation
Some boxes are stubborn — one appliance, lots of state, no twin that can take half the tunnels cleanly. That is when you carefully upgrade the same box in a window. Parallel blue-green or canary slices need workable dual paths that this stateful gear may not offer.
Full Explanation
In-place upgrade during a controlled maintenance window is the realistic strategy when a stateful network appliance cannot cleanly run two versions side by side—for example, a city VPN aggregator that terminates tunnels and holds session state. Parallel patterns break when state and traffic cannot be split safely. Blue-green with two fully independent appliances always processing identical live sessions fails when session affinity and appliance state make true dual active versions impractical. Canary that sends 5% of encrypted tunnels to a second appliance that cannot share state fails because partial tunnel steering without shared state drops or breaks sessions. Rolling across a large identical fleet fails when only one appliance terminates the tunnels. Exam caveat: deployment strategy questions are constraint-driven; stateful singletons often force in-place despite the popularity of blue-green and canary elsewhere. Operational check: schedule a civic maintenance window, capture configuration backups, verify vendor upgrade path and firmware compatibility, drain or notify VPN users as required, upgrade, and validate tunnel establishment and MFA before releasing the window. Document the singleton constraint so future automation proposals do not assume unsupported parallel VPN appliances for this municipal edge.