A server administrator is troubleshooting a performance issue on a critical application server. After analyzing logs, the administrator confirmed a theory that a recent OS update is causing a memory leak. A plan to uninstall the update has been approved, and stakeholders have been notified. According to CompTIA's troubleshooting methodology, which of the following is the BEST next step for the administrator to take?
Uninstall the update and monitor memory utilization.
Document the findings, actions, and resolution in the knowledge base.
Establish a new theory of probable cause.
Uninstall the update and apply the newest available patch from the vendor.
The correct answer is to make one change at a time and test to confirm if the change has resolved the problem. In this scenario, the administrator should uninstall the specific update suspected of causing the issue and then immediately monitor the server's memory usage to verify that the problem is resolved. Applying a new patch simultaneously would introduce a second variable, making it impossible to determine which action fixed the issue. Establishing a new theory is incorrect because a probable cause has already been confirmed and the administrator is in the implementation phase of the troubleshooting process. Documenting the solution is a later step in the methodology, which should be performed after the solution has been implemented and full system functionality has been verified.