Palo Alto Networks Certified Network Security Engineer (PCNSE) — Question 210

An administrator wants to upgrade a firewall HA pair to PAN-OS 10.1. The firewalls are currently running PAN-OS 8.1.17. Which upgrade path maintains synchronization of the HA session (and prevents network outage)?

Answer options

• A. Upgrade directly to the target major version.
• B. Upgrade the HA pair to a base image.
• C. Upgrade one major version at a time.
• D. Upgrade two major versions at a time.

Correct answer: C

Explanation

The correct answer is C, as upgrading one major version at a time allows for synchronized updates between the HA pair, preventing any disruption in service. Options A and D involve skipping versions, which can lead to synchronization issues. Option B does not follow the recommended upgrade path for maintaining HA synchronization.