PCNSE · Question #776
PCNSE Question #776: Real Exam Question with Answer & Explanation
The correct answer is D: Upgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the. For active/passive HA upgrades, best practices minimize downtime by upgrading the passive peer first (Option D), rebooting it to confirm stability, restoring HA sync, and then upgrading the active peer. This keeps services running on the active firewall during the passive upgrade
Question
Panorama is being used to upgrade the PAN-OS version on a pair of firewalls in an active/passive high availability (HA) configuration. The Palo Alto Networks best practice upgrade steps have been completed in Panorama (Panorama upgraded, backups made, content updates, and disabling "Preemptive" pushed), and the firewalls are ready for upgrade. What is the next best step to minimize downtime and ensure a smooth transition?
Options
- AUpgrade both HA peers at the same time using Panorama's "Group HA Peers" option to ensure
- BSuspend the active firewall, upgrade it first, and reboot to verify it comes back online before
- CPerform the upgrade on the active firewall first while keeping the passive peer online to maintain
- DUpgrade only the passive peer first, reboot it, restore HA functionality, and then upgrade the
Explanation
For active/passive HA upgrades, best practices minimize downtime by upgrading the passive peer first (Option D), rebooting it to confirm stability, restoring HA sync, and then upgrading the active peer. This keeps services running on the active firewall during the passive upgrade, ensuring a smooth transition with failover capability intact.
Topics
Community Discussion
No community discussion yet for this question.