A citizen payments API must support instant rollback if a new release fails health checks. Which deployment strategy best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Blue/green keeps the old city hall open while the new wing gets inspected. If the new release fails its health check, flip citizens back to the old door—no rebuild-from-scratch panic.
Full Explanation
Citizen payment APIs demand fast recovery when a bad release fails health checks because downtime directly blocks fees, fines, and essential transactions. Blue/green deployment keeps a prior healthy environment available so rollback is a traffic shift rather than an emergency rebuild, meeting the instant-rollback requirement with clear cutover and cutback semantics on the load balancer or deployment controller. All-at-once replacement destroys the previous capacity footprint and leaves operators without a ready fallback when health checks fail mid-release. Manual FTP of binaries during business hours is slow, error-prone, unauditable, and incompatible with automated health-gated releases expected for public payments. Disabling health checks so failed versions keep serving traffic hides failure instead of protecting citizens and payment integrity. Exam caveat: blue/green still needs compatible data migrations—schema changes that cannot roll back with the application can turn a quick traffic shift into a data incident even when compute flips cleanly. Operational check: rehearse a failed health check in a staging blue/green pair, verify traffic returns to the prior environment within the target RTO, and confirm payment synthetic checks and ledger write paths recover on the known-good version.