nerdexam
Palo_Alto_Networks

PCNSE · Question #778

An engineer has been given approval to upgrade their environment to the latest of PAN-OS. The environment consists of both physical and virtual firewalls, a virtual Panorama HA pair, and virtual log…

The correct answer is D. Upgrade Panorama, upgrade the log collectors, upgrade the firewalls. The recommended upgrade order for a Palo Alto Networks environment is Panorama first, followed by log collectors, and then the managed firewalls.

Submitted by viktor_hu· Apr 18, 2026Operate

Question

An engineer has been given approval to upgrade their environment to the latest of PAN-OS. The environment consists of both physical and virtual firewalls, a virtual Panorama HA pair, and virtual log collectors. What is the recommended order of operational steps when upgrading?

Options

  • AUpgrade the firewalls, upgrade log collectors, upgrade Panorama
  • BUpgrade the firewalls, upgrade Panorama, upgrade the log collectors
  • CUpgrade the log collectors, upgrade the firewalls, upgrade Panorama
  • DUpgrade Panorama, upgrade the log collectors, upgrade the firewalls

How the community answered

(51 responses)
  • A
    10% (5)
  • B
    4% (2)
  • C
    14% (7)
  • D
    73% (37)

Why each option

The recommended upgrade order for a Palo Alto Networks environment is Panorama first, followed by log collectors, and then the managed firewalls.

AUpgrade the firewalls, upgrade log collectors, upgrade Panorama

Upgrading firewalls before Panorama can lead to compatibility issues where Panorama might not be able to manage the newer firewall OS versions.

BUpgrade the firewalls, upgrade Panorama, upgrade the log collectors

Upgrading firewalls before Panorama can lead to compatibility issues where Panorama might not be able to manage the newer firewall OS versions.

CUpgrade the log collectors, upgrade the firewalls, upgrade Panorama

Upgrading log collectors before Panorama is not the recommended order, as Panorama should always be upgraded first to ensure management compatibility across the environment.

DUpgrade Panorama, upgrade the log collectors, upgrade the firewallsCorrect

Upgrading Panorama first ensures that the central management system is compatible with and can manage all subsequently upgraded components, followed by log collectors to maintain logging functionality, and finally the managed firewalls.

Concept tested: PAN-OS upgrade order

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/maintain/upgrade-pan-os/upgrade-the-firewall-pan-os-software/upgrade-a-firewall-with-panorama

Topics

#PAN-OS Upgrade#Panorama#Log Collectors#Upgrade Procedure

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice