nerdexam
Palo_Alto_Networks

PCNSE · Question #769

A firewall engineer needs to patch the company's Palo Alto Networks firewalls to the latest version of PAN-OS. The company manages its firewalls by using Panorama. Logs are forwarded to Dedicated…

The correct answer is C. Panorama, Dedicated Log Collectors, and WildFire appliances must be patched to the target. When patching PAN-OS in a Panorama-managed environment with Log Collectors and WildFire appliances, all components must be updated to compatible PAN-OS versions.

Submitted by saadiq_pk· Apr 18, 2026Plan

Question

A firewall engineer needs to patch the company's Palo Alto Networks firewalls to the latest version of PAN-OS. The company manages its firewalls by using Panorama. Logs are forwarded to Dedicated Log Collectors, and file samples are forwarded to WildFire appliances for analysis. What must the engineer consider when planning deployment?

Options

  • AOnly Panorama and Dedicated Log Collectors must be patched to the target PAN-OS version
  • BPanorama, Dedicated Log Collectors, and WildFire appliances must have the target PAN-OS
  • CPanorama, Dedicated Log Collectors, and WildFire appliances must be patched to the target
  • DOnly Panorama must be patched to the target PAN-OS version before updating the firewalls.

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    81% (21)
  • D
    12% (3)

Why each option

When patching PAN-OS in a Panorama-managed environment with Log Collectors and WildFire appliances, all components must be updated to compatible PAN-OS versions.

AOnly Panorama and Dedicated Log Collectors must be patched to the target PAN-OS version

This option incorrectly excludes WildFire appliances, which are critical components of the security infrastructure and require compatible PAN-OS versions for proper functionality.

BPanorama, Dedicated Log Collectors, and WildFire appliances must have the target PAN-OS

This choice is incomplete as it omits the crucial detail that all listed components 'must be patched to the target PAN-OS version' for compatibility.

CPanorama, Dedicated Log Collectors, and WildFire appliances must be patched to the targetCorrect

For consistent operation, full feature functionality, and proper integration, Panorama, its managed firewalls, Dedicated Log Collectors, and WildFire appliances must all be updated to compatible PAN-OS versions. This ensures that all components can communicate effectively and correctly process logs and samples.

DOnly Panorama must be patched to the target PAN-OS version before updating the firewalls.

This option is incorrect because Log Collectors and WildFire appliances also require patching to compatible PAN-OS versions for their services to function correctly with the updated Panorama and firewalls.

Concept tested: PAN-OS upgrade order and compatibility

Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/software-and-updates/best-practices-for-pan-os-upgrades.html

Topics

#PAN-OS Upgrade#Panorama Management#System Compatibility#Upgrade Planning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice